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Notational Conventions 


KEY TERMS 
placeholders 
Examples 
[optional items] 


{ choicel | choice2} 


Repeating 
elements... 


START 


END 


Bold type indicates text that must be typed 
exactly as shown. This includes instructions, 
directives, registers, commands, and program 
names. 


Italics indicate variable information supplied 
by the user. 


The typeface shown in the left column 
simulates the appearance of source code as it 
appears on a screen or printed listing. 


Double brackets indicate that the enclosed item 
is optional. 


Braces indicate a choice between two or more 
items. A vertical bar separates the choices. At 
least one of the items must be chosen unless 
all the items are enclosed in double brackets. 


Ellipsis dots following an item indicate that 
more items having the same form may be 


typed. 


Vertical ellipsis dots indicate that additional 
lines may be added between the starting and 
ending elements. 
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Programs 


MASM 
Command-Line Syntax 
Options 
Environment Variables - 
LINK 


Command-Line Syntax 

Options 

Environment Variables 
Microsoft® CodeView® Debugger 


Command-Line Syntax 

Options 

Window Commands 

Format Specifiers 

Size Specifiers 

Dialog Commands 
MAKE 


Command-Line Syntax 
Options 
Syntax for MAKE Files 
Syntax for Macro Definitions 
Syntax for Inference Rules 
Syntax for Dependency Rules 
Syntax for Using Macros 
Special Macro Names 
Environment Variable 

LIB 


Command-Line Syntax 
Commands 


CREF 
Command-Line Syntax 
SETENV 
Command-Line Syntax 
EXEPACK 
Command-Line Syntax 
EXEMOD 
Command-Line Syntax 
Options 
ERROUT 
Command-Line Syntax 
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MASM 


Command-Line Syntax 
MASM [foptions} sourcefile [,fobjectfile} [.[listingfile} [crossreferencefile}} I {;] 


Options 

Option Action 

/A Writes segments in alphabetical order 
/Bnumber Sets buffer size 

[C Specifies a cross-reference file 

/D Creates a Pass 1 listing 

/Dsymbolf{=value] Defines assembler symbol 

/E Emulates floating-point instructions 

/H Lists options and command-line syntax 
Npath Sets include-file search path 

/L Specifies an assembly-listing file 

IML Preserves case in names 

(MU Converts names to uppercase (default) 

IMX Preserves case in public and external names 
IN Suppresses tables in listing file 

/P Checks for impure code 

IS Writes segments in sequential order (default) 
IT Suppresses messages for successful assembly 
IV Displays extra statistics 

/W { OlLI2 } Sets error display level 

/X Shows false conditional blocks in listings 
[Z Displays error lines on screen 

/ZD Puts line number information in the object file 
/Z1 Puts symbolic and line number information in the 


object file (for CodeView® debugger) 


Environment Variables 


Variable Description 
INCLUDE Sets search path for include files 
MASM Specifies default assembler options 


MASM 3 __- 


‘ 


LINK 


Command-Line Syntax 


LINK [options] objectfiles [,fexecutablefile} {,{mapfile}{,{libraryfiles} VaR C33 


Options 


Option Action 
Prevents prompting when errors are encountered (for 
make and batch files) 


Creates a special-format executable file containing 
symbolic information needed by the CodeView 


/B 


[CO 


/CP:number 
/DO 


/E 
IF 
/HE 
a 


/L 
IM[:number] 


INOD 
/NOF 
{NOI 


INOP 
IPAC 
/PAU 


IQ 


{ST:number 


Note: Several rarely used options not listed above are described in the CodeView® 
and Utilities manual. 


debugger 


Sets the program's maximum allocation to number 


of paragraphs 


Orders segments in the default order used by 
Microsoft high-level languages 

Packs the executable file 

Optimizes far calls 

Displays LINK options 

Displays linking information, including the name 
of each input module as it is linked 


Lists line numbers and addresses of source 
statements in the map file 


Lists all public symbols in the map file (number is 
the maximum number of symbols) 


Ignores default libraries 
Disables far call optimization 
Distinguishes between uppercase and lowercase 


letters 


Disables code segment packing 
Packs contiguous code segments 
Pauses during the link session for disk changes 


Creates an in-memory (load-time) library for a 
Quick language (such as QuickBASIC) 


Sets the stack size to number, which may be up to 


65,536 bytes 
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Environment Variables 


Variable Description 

LIB Sets search path for library files 
LINK Specifies default linker options 
TMP Sets path for the VM.TMP file 


Microsofte CodeViewo Debugger 


Command-Line Syntax 


CV [options] executablefile [arguments] 


Options 

Option Action 

/2 Enables use with two monitors and two graphics 
adapters 

143 Starts in 43-line mode on EGA 

/B Starts in black-and-white mode 

/Ccommands Executes commands on Start-up 

/D Turns off nonmaskable interrupt and 8259 interrupt 
trapping (necessary for some compatibles) 

/E Enables expanded memory support 

/F Starts with screen flipping (exchanges screens by 
flipping video pages) 

/T Forces the debugger to handle nonmaskable 
interrupt and 8259 interrupt trapping (necessary for 
some compatibles) 

/M Disables the mouse 

iP Disables palette-register saving (necessary for some 
EGA-compatible adapters) 

IS Starts with screen swapping (exchanges screens by 
changing buffers) 

IT Starts in sequential mode 

iW Starts in window mode (necessary for some 
compatibles) 
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Window Commands 


Action Keyboard Mouse 


Open help screen 


Toggle register 
window 

Toggle display 
mode 


Switch to output 
screen 


Go 

Switch 
display/dialog 
Execute to here 
Trace through 


Set breakpoint 
here 


Step over 
Change flag 
Scroll up line 
Scroll up page 
Scroll to top 
Scroll down line 
Scroll down page 
Scroll to bottom 
Scroll to location 
Move cursor up 
Move cursor down 


Make window 
grow 

Make window 
tiny 

Find text 
Add watch 
expression 


Delete watch 
statement 


6 CODEVIEW 


Fi 
F2 


F3 


F4 


FS 
F6 


F7 at cursor 
F8 
F9 at cursor 


F10 
None 
None 
PGUP 
HOME 
None 
PGDN 
END 
None 

UP arrow 
DOWN arrow 
CTRL+G 


CTRL+T 


CTRL+F 
CTRL+W 


CTRL+U 


Help menu 
Registers from View menu 


Source, Mixed, or Assembly from 
View menu 


Output from View menu 


Click left on Go 
None 


Click right at location 
Click left on Trace 
Click left at location 


Click right on Trace 
Click left on flag 

Click left on up arrow 
Click left above elevator 
Drag elevator to top 
Click left on down arrow 
Click left below elevator 
Drag elevator to bottom 
Drag elevator to location 
None 

None 

Drag line up or down 


Drag line up or down 


Find from Search menu 
Add Watch from Watch menu 


Delete Watch from Watch menu 
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Format Specifiers 


Use with Display Expression, Watch Expression, and Tracepoint 
Expression dialog commands. 


Character Argument Type Output Format 


d ori Integer Signed decimal integer 

u Integer Unsigned decimal integer 

0 Integer Unsigned octal integer 

xor X Integer Hexadecimal integer 

f Floating point Signed value in floating-point 
decimal format with six decimal 
places | 

eor E Floating point Signed value in scientific-notation Y 
format with up to six decimal places ss 
(trailing zeros or decimal point = 
truncated) : | 

gor G Floating point Signed value with floating-point 


decimal or scientific notation, 
whichever is more compact 


Cc Character Single character 


S String Characters printed up to the first 
null (C null-terminated strings only) 


Note: If appropriate for the language, the prefix | can be used with the integer 
format specifiers (d, 0, u, x, and X) to specify a four-byte integer. The prefix h can 
be used with the same types to specify a two-byte integer. 


Size Specifiers 


Use with Dump, Enter, Watch Memory, and Tracepoint Memory dialog 
commands. 


Type Description © 
No type The current type (default is byte) 3 
A (ASCII) ASCII (8-bit) characters oy 
B (Byte) Byte (8-bit) hexadecimal values B 
I (Integer) Integer (16-bit) decimal values ae 
U (Unsigned) Unsigned (8-bit) decimal values 

W (Word) Word (16-bit) hexadecimal values 

D (Doubleword) Doubleword (32-bit) hexadecimal values 

S (Short Real) Short-real (32-bit) values 

L (Long Real) Long-real (64-bit) values 


T (10-Byte Real) 10-byte-real values 
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Dialog Commands 


Name Syntax ___Description 
8087 7 ' Displays coprocessor or 


Assemble 


A [addr] 


Break Clear BC {listi*} 


Break BD {listl*} 
Disable 
Break BE {listi*} 
Enable 
Break List BL 
Break Set BP [addr[pc}{"cmds" J] 
Comment * comment 
Compare C range addr 
Memory 
Current 
Location 
Delay : 
Display ? expr[ fmt] 
Dump D[type] [range] 
Enter Ef{type] addr [list] 
Examine X?mod!proc.{syml*} 
Symbols 
Execute E 
Fill F range list 
Memory 
Go G [addr] 
Help H 
Load L [args] 
Move M range addr 
Memory 
Option O[FIBICI3[+!-}] 
Pause " 

Port Input _—I port 
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emulator status 


Assembles mnemonics starting 
at given address 


Clears listed breakpoints 
Disables listed breakpoints 


Enables listed breakpoints 


Lists current breakpoints 


Sets breakpoint at given address 
with the specified pass count 
(pc); given commands are 
executed at each break 


Displays explanatory text 


Compares bytes in range with 
bytes beginning at given 
address; displays mismatches 


Displays the current source line 


Delays redirected commands 
Displays expression in format 


Dumps memory range in type 
format 


Enters memory values in type 
format 


Displays symbols in given 
module and procedure 

Executes in slow motion 

Fills range with the listed values 


Executes to address or to end 
Displays on-line help 


Restarts program with given 
arguments 


Copies values in range to the 
given address 


Toggles flip/swap, bytes coded, 
case sense, or 386 option 


Interrupts redirected commands 
and waits for keystroke 


Displays byte from port 
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Port Output 


Program 
Step 


Quit 
Radix 
Redirection 


Redraw 
Register 


Screen 
Exchange 


Search Text 


Search 
Memory 


Set Mode 


Shell 
Escape 


Stack Trace 


Tab Set 
Trace 


Tracepoint 


Unassemble 


Use 
View 


Watch 


Watch 
Delete 


Watch List 
Watchpoint 


O port value 
P [count] 


Q 

N[ radix] 
{T]>[>]device 
<device 
=device 


@ 


Rfregister{[=Jexpr]] 


\ 

/[regexpr] 
S range list 
Sf+l-l&] 
![command] 
K 


#number 
T [count] 


TP? expr[,fmt] 
TP type] range 


U[range] 


USE[/anguage] 
V f.[file:Jline] 


W? expr fmt} 
W\Itype] range 
Y { numberi* } 


Ww 
WP? expr fmt] 


Sends byte value to port 


Executes, stepping over calls; 
repeats count times 


Exits to DOS 
Sets input radix 


Redirects input or output to or 
from device 


Redraws the screen 


Displays registers and flags, or 
sets new registers and flags 


Displays the output screen 


Searches for a regular expression 


Searches range for listed values, 
and displays where values are 
found 


Toggles source, assembly, and 
mixed modes 


Escapes to a new DOS shell 


Displays routines currently 
active on the stack 


Sets tab size to number 


Executes, tracing into calls; 
repeats count times 


Breaks when given expression 
or memory value changes; 
displays in watch window 


Displays unassembled 
instructions 


Switches expression evaluators 


Displays specified source lines 
of given file 


Displays given expression or 
memory range in watch window 


Deletes (yanks) the given watch 
statements 


Lists watch statements 


Breaks when given expression is 
true; displays in watch window 
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MAKE 


Command-Line Syntax 
MAKE [options] [macrodefinitions] filename 


Options 

Option Action 

/D Displays the last modification date of each file as 
the file is scanned 

/T Ignores exit codes returned by programs called from 
the MAKE description file; MAKE continues 
execution of the next lines of the description file 
despite the errors 

IN Displays commands that would be executed by a 
description file, but does not actually execute the 
commands 

[S Executes in silent mode; lines are not displayed as 


they are executed 


Syntax for MAKE Files 


[macrodefinitions] 
linferencerules] 
dependencyrules 


Syntax for Macro Definitions 


name=value 


Syntax for Inference Rules 


InextenSion.outextension : 
command 
[command] 


Syntax for Dependency Rules 


targetfile:dependentfiles|#comment] 
[#comment] 
command{#comment] 
[command] [#comment] 
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Syntax for Using Macros 


$(name) 


Special Macro Names 


Name Value Substituted 

$* Base-name portion of the outfile (no extension) 
$@ Complete outfile name 

$** Complete list of infiles 


Environment Variable 


Variable Description 
INIT Specifies location of the TOOLS.INI file, which 


may contain inference rules 


LIB 


Command-Line Syntax 
LIB oldlibrary {/P[AGESIZE]: number] [commands] [,{lisifile} [| faewlibrarn PR G;] 


Commands 

Code Task Description 

+ Appends an object file or library file 

- Deletes a module 

-+ Replaces a module by deleting it and appending an 
object file with the same name 

- Copies an object module onto an independant 
object file 

-* Moves a module out of the library by copying it to 


an object file and then deleting it 
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CREF 


Command-Line Syntax 


CREF crossreferencefile{crossreferencelisting} 


SETENV 


Command-Line Syntax 


SETENV filename[environmentsize} 


EXEPACK 


Command-Line Syntax 
EXEPACK exefile packedfile 


EXEMOD 


Command-Line Syntax 
EXEMOD exefile [options] 


Options 
Option Effect 
ISTACK hexnum _ Sets the stack size by setting the initial value of 


SP to hexnum 

Sets the minimum allocation value to hexnum 
paragraphs 

Sets the maximum allocation value to hexnum 
paragraphs 


/MIN hexnum 


IMAX hexnum 


ERROUT 


Command-Line Syntax 
ERROUT [f/f stderrfile] command [> stdousfile} 
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Directives 


Directives 


Directives 
Operators 


oS Sc cL 


Topical Cross-Reference for Directives 


Simplified 
Segment 
-MODEL 
.CODE 
STACK 
.DATA 
DATA? 
.FARDATA 
.FARDATA? 
.CONST 
DOSSEG 


Segment 


SEGMENT 
ENDS 
GROUP 
ASSUME 
DOSSEG 
END 


Code Labels Repeat Blocks Processor 


PROC 
ENDP 
LABEL 


PUBLIC 
EXTRN 
COMM 
INCLUDELIB 


Structure 
and Record 
RECORD 


STRUC 
ENDS 


Macros 
MACRO 
ENDM 
EXITM 
LOCAL 
PURGE 


Equates 


EQU 


REPT 
IRP 
IRPC 
ENDM 


Conditional 


Assembly 


IF1 

IF2 

IF 

IFE 

IFB 

IFNB 

IFDEF 
IFNDEF 
IFDIF/IFDIFI 
IFIDN/IFIDNI 
ELSE 

ENDIF 


Conditional E 


-ERR 
-ERRI 
-ERR2 
-ERRE 
-ERRNZ 
-ERRB 
-ERRNB 
-ERRDEF 
-ERRNDEF 


-ERRDIF/.ERRDIFI 
-ERRIDN/.ERRIDNI 


8086 
.286 
.286P 
.386 


TITLE 
SUBTTL 


PAGE 
-LIST 
XLIST 
.LFCOND 
-SFCOND 
-TFCOND 
~LALL 
SALL 
AALL 
-CREF 
.XCREF 


Miscellaneous 
COMMENT 

% OUT 

.RADIX 

END 

INCLUDE 
INCLUDELIB 
NAME 


Topical Cross-Reference for Operators 


Logical 


AND 
OR 
XOR 
NOT 
SHL 
SHR 


Relational 
EQ 
NE 
GT 
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Directives 


name = expression 
Assigns the numeric value of expression to name. The symbol 
may be redefined later. 


186 
Enables assembly of instructions for the 80186 processor. 
.286 
Enables assembly of nonprivileged instructions for the 80286 
processor. 
.286P 


Enables assembly of all instructions (including privileged) for 
the 80286 processor. 


287 
Enables assembly of instructions for the 80287 coprocessor. 
386 
Enables assembly of nonprivileged instructions for the 80386 
processor. 
.386P 


Enables assembly of all instructions (including privileged) for 
the 80386 processor. 


.387 


Enables assembly of instructions for the 80387 coprocessor. 


.8086 
Enables assembly of 8086 instructions (and the identical 8088 
instructions); disables assembly of instructions of later 
processors. This is the default mode. 


8087 
Enables assembly of 8087 instructions and disables assembly of 
instructions available only with later coprocessors. This is the 
default mode. 


ALIGN number 
Aligns the next variable or instruction on a byte that is a 
multiple of number. 


-ALPHA 
Orders segments alphabetically. 


ASSUME segregister:name[,segregister:name]... 
Selects segregister to be the default segment register for all 
symbols in the named segment or group. If name is NOTHING, 
no segment register is associated with the segment. ~ 
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CODE [name] 
When used with .MODEL, indicates the start of a code segment, 
which may have name for medium, large, and huge models 
(default segment name _TEXT for small and compact models, or 
module_TEXT for other models). 

COMM definition| definition]... 
Creates a communal variable with the attributes specified in 
definition. Each definition has the following form: 


(NEARIFAR ] /abel:size[:count} 
The /abel is the name of the variable. The size can be any size 


specifier (BYTE, WORD, etc.). The count specifies the number 
of data objects (one is the default). 


COMMENT delimiter [text] 
text 


delimiter [text] 
Treats all text between or on the same line as the delimiters asa 


comment. 


CONST 
When used with .MODEL, starts a constant data segment (with 


segment name CONST). 
~.CREF 


Restores listing of symbols in the cross-reference listing file. 


DATA 
When used with .MODEL, starts a near data segment for 
initialized data (segment name _DATA). 


DATA? 
When used with .MODEL, starts a near data segment for 


uninitialized data (segment name _ BSS). 


DOSSEG 


Orders segments according to the DOS segment convention. 


fname] DB initializer [initializer]... 
Allocates and optionally initializes a byte of storage for each 
initializer. 

[name] DW initializer { initializer]... 
Allocates and optionally initializes a word (2 bytes) of storage 
for each tnitializer. 

[name] DD initializer [initializer]... 
Allocates and optionally initializes a doubleword (4 bytes) of 
storage for each initializer. 


[name] DF initializer [initializer]... 
Allocates and optionally initializes a farword (6 bytes) of storage 
for each initializer. 


[name] DQ initializer [initializer]... 
Allocates and optionally initializes a quadword (8 bytes) of 
storage for each initializer. 
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[name] DT initializer [initializer]... 
Allocates and optionally initializes 10 bytes of storage for each 
initializer. 

ELSE 
Marks the beginning of an alternate block within a conditional 
block. See IF. 

END [startaddress] 


Marks the end of a module and, optionally, sets the program 
entry point to startaddress. 


ENDIF 
Terminates a conditional block. See IF. 

ENDM 
Terminates a macro or repeat block. See MACRO, REPT, IRP, 
or IRPC. 

name ENDP 
Marks the end of procedure name previously begun with PROC. 
See PROC. 

name ENDS 


Marks the end of segment name or of structure name previously 
begun with SEGMENT or STRUC. See SEGMENT and 
STRUC. 


name EQU I<]Jexpression[>] 
Assigns expression to name. If expression is enclosed in angle 
brackets, it will be interpreted as a text expression. Numeric 
equates defined with EQU cannot be redefined, but text equates 
can be redefined. 

-ERR 


Generates an error. 


-ERRI 


Generates an error on Pass | only. 


-ERR2 


Generates an error on Pass 2 only. 


-ERRB <argument> 


Generates an error if argument is blank. 


-ERRDEF name 


Generates an error if name is a Previously defined label, variable, 
or symbol. 


-ERRDIF[I] <argumentl>, <argument2> 


Generates an error if the arguments are different. If ] is given, 
the argument comparison is case insensitive. 


-ERRE expression 


Generates an error if expression is false (0). 
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-ERRIDN{IT] <argumentl>, <argument2> 
Generates an error if the arguments are identical. If I is given, 
the argument comparison is case insensitive. 


-ERRNB <argument> 


Generates an error if argument is not blank. 


-ERRNDEF name 


Generates an error if name has not been defined. 


-ERRNZ expression 


Generates an error if expression is true (nonzero). 


EVEN 


Aligns the next variable or instruction on an even byte. 


EXITM 


Terminates expansion of the current repeat or macro block and 
begins assembly of the next statement outside the block. 


EXTRN name:type [,name:type]... 


Defines one or more external variables, labels, or symbols called 
name whose type is fype. 


FARDATA [name] 
When used with .MODEL, starts a far data segment for 
initialized data (segment name FAR_DATA or name). 


-FARDATA? [rname} 
When used with .MODEL, starts a far data segment for 
uninitialized data (segment name FAR_BSS or name). 


name GROUP segmentl,segment]... 
Add the specified segments to the group called name. 


IF expression 
ifstatements 
[ELSE 
elsestatements || 
ENDIF 


Grants assembly of ifstatements if expression is true (nonzero). 
Optionally assembles elsestatements if expression is false (0). 


IF 1 


Grants assembly on Pass 1 only. See IF for complete syntax. 


IF2 


Grants assembly on Pass 2 only. See IF for complete syntax. 


IFB <argument> 
Grants assembly if argument is blank. See IF for complete 


syntax. 

IFDEF name 
Grants assembly if name is a previously defined label, variable, 
or symbol. See IF for complete syntax. 
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IFDIF [I] <argument!>, <argument2> 
Grants assembly if the arguments are different. If I is given, the 
argument comparison is case insensitive.See IF for complete 
syntax. 


IFE expression 
Grants assembly if expression 1s false (0). See IF for complete 
syntax. 


IFIDN[I} <argument!>, <argument2> 
Grants assembly if the arguments are identical. If I is given, the 
argument comparison is case insensitive. See IF for complete 
syntax. 


IFNB <argument> 
Grants assembly if argument is not blank. See IF for complete 
syntax. 


IFNDEF name 
Grants assembly if name has not been defined. See IF for 
complete syntax. 


INCLUDE filespec 
Inserts source code from the source file given by filespec into 
the current source file during assembly. 


INCLUDELIB library 
Informs the linker that the current module should be linked with 
library. 


IRP parameter,<argument{,argument]...> 

statements 

ENDM 
Marks a block that will be repeated for as many arguments as are 
given, with the current argument replacing parameter on each 
repetition. 


IRPC parameter,string 
statements 
ENDM 


Marks a block that will be repeated for as many characters as 
there are in string, with the current character replacing parameter 
on each repetition. 


name LABEL type 
Creates a new variable or label by assigning the current location- 
counter value and the given type to name. 


-LALL 


Starts listing of all statements in macros. 


»-LFCOND 


Starts listing of statements in false conditional blocks. 


«LIST 
Starts listing of statements. This is the default. 
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LOCAL localname [,localname]... 
Declares localname within a macro as a placeholder for an actual 
name to be created when the macro is expanded. 

name MACRO [parameter [,parameter]...] 


statements 
ENDM 


Marks a macro block called name and establishes parameters as 
placeholders for arguments passed when the macro is called. 


MODEL memorymodel 
Initializes the program memory model. The memorymodel can be 
SMALL, COMPACT, MEDIUM, LARGE, or HUGE. 


NAME modulename 
Ignored in Version 5.0. The module name is always the base 
name of the source file. 


ORG expression 
Sets the location counter to expression. 


%OUT text 


Displays text to the standard output device (the screen). 


PAGE [[length], width] 
Sets line /ength and character width of the program listing. If no 
arguments are given, generates a page break. 


PAGE + 
Increments section-page numbering. 
label PROC [NEARIFAR] 
Statements 
RET [constant] 


label ENDP 
Marks start and end of a procedure block called label. The 
statements the block can be called with the CALL instruction. 


PUBLIC name [,name]... 
Makes each variable, label, or absolute symbol specified as name 
available to all other modules in the program. 


PURGE macroname [,macroname]... 
Deletes the specified macros from memory. 


-RADIX expression 


Sets the input radix to the value of expression. 


recordname RECORD field{ field]... 


Declares a record type consisting of the specified fields. Each 
field has the following form: 


fieldname:width{[= expression] 


The fieldname names the field, width specifies the number of 
bits, and expression gives its initial value. 
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REPT expression 
statements 
ENDM 


Marks a block that is to be repeated expression times. 


SALL 


Suppresses listing of macro expansions. 


name SEGMENT [align] [combine] [use] {'class'] 
Statements 
name ENDS 


Defines a program segment called name having segment 
attributes align, combine, use, and class. 


SEQ 


Orders segments sequentially (the default order). 


-SFCOND 


Suppresses listing of conditional blocks whose condition 
evaluates to false (0). This is the default. 


STACK [size] 
When used with .MODEL, indicates the start of a stack segment 
(with segment name STACK). The optional size specifies the 
number of bytes for the stack (default 1024). 

name STRUC 

fields 

name ENDS 
Declares a structure type having the specified fields. Each field 
must be a valid data definition (using DB, DW, etc.). 


SUBTTL text 
Defines the listing subtitle. 


-TFCOND 


Toggles listing of false conditional blocks. 


TITLE text 
Defines the program listing title. 

XALL 
Starts listing of macro expansion statements that generate code 
or data. This is the default. 


-XCREF [name[,name]...] 
Suppresses listing of symbols in the cross-reference listing file. 
If names are specified, only the given symbols will be 
suppressed. 


-XLIST 


Suppresses program listing. 


Operators 


expression! * expression2 
Returns expression! times expression2. 


expression! | expression2 
Returns expression! divided by expression2. 


expressionl + expression2 
Returns expression! plus expression2. 


expression! = expression2 
Retums expression] minus expression2. 


-expression 
Reverses the sign of expression. 


segment: expression 
Overrides the default segment of expression with segment. The 
segment may be a segment register, a group name, or a segment 
name. The expression can be a constant, a memory expression, 
or a SEG expression. 


variable . field 
Returns the offset of field plus the offset of variable. 


[expression] ] [expression2] 


Returns the offset of expression! plus the offset of expression2. 


<text> 
Treats text in a macro argument as a single litera] element. 


! character 
Treats character in a macro argument as a literal character rather 
than as an operator or symbol. 


stext 
Treats fext aS a comment. 


33fext 

99 
Treats text as a comment that will not be listed in expanded 
macros. 


Totext 
Treats fext in a macro argument as an expression. 


&parameter 


Replaces parameter with its corresponding argument value. 


expression! AND expression2 
Returns the result of a bitwise Boolean AND done on 
expression! and expression2. 


count DUP (initialvalue[ initialvalue]...) 
Specifies count number of declarations of initialvalue. 
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expression! EQ expression2 
Returns true (-1) if expression] equals expression2, or returns 
false (0) if it does not. 


expression] GE expression2 
Returns true (-1) if expression] is greater than or equal to 
expression2, or returns false (0) if it is not. 


expressionl GT expression2 
Returns true (-1) if expression] is greater than expression2, or 
returns false (0) if it is not. 


HIGH expression 


Returns the high byte of expression. 


2PM SL SS 8 OI COWEN oO AO NAVAMLE.S,*.2, 8 SICINEY DD Sete NNN WA ARS VASA®.®, ©.0, 


expression! LE expression2 
Returns true (-1) if expression] is less than or equal to 
expression2, or returns false (0) if it is not. 


LENGTH variable 


Returms the number of data objects in variable if variable was 
defined with the DUP operator. 


LOW expression 


Retums the low byte of expression. 


expression] LT expression2 
Returns true (-1) if expression] is less than expression2, or 
returns false (0) if it is not. 


MASK {recordfieldname|record} 
Returns a bit mask in which the bits for recordfieldname or 
record are set and all other bits are cleared. 


expression! MOD expression2 
Returns the remainder of dividing expression! by expression2. 


— JOSSBIO4 


expression! NE expression2 
Returns true (-1) if expression! does not equal expression2, or 
returns false (0) if it does. 


NOT expression 


Returns expression with all bits reversed. 


OFFSET expression 


Returns the offset of expression. 


expression! OR expression2 
Returns the result of a bitwise Boolean OR done on expression! 
and expression2. 


. Jossaoqidon 


type PTR expression 
Forces the expression to be treated as having the specified type. 


SEG expression 
Returns the segment of expression. 


expression SHL count 
Returns the result of shifting the bits of expression left count 
number of bits. 
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SHORT label 
Sets the type of label to short (having a distance less than 128 
bytes from the start of the next instruction). 


expression SHR count 
Returns the result of shifting the bits of expression-right count 
number of bits. 


SIZE variable 


Returns the number of bytes allocated for variable if variable was 
defined with the DUP operator. 


THIS type 
Returns an operand of specified type whose offset and segment 
values are equal to the current location-counter value. 


TYPE expression 
Returns the type of expression. 


TYPE expression 
Returns a byte defining the mode and scope of expression. 


WIDTH {recordfieldname|record} 


Returns the width in bits of the current recordfieldname or record. 


expressionl XOR expression2 
Returns the result of a bitwise Boolean XOR done on 
expression! and expression2. 
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Interpreting Processor Instructions 
Flags 
Syntax 
Examples 
Clock Speeds 
Timings on the 8088 and 8086 
Timings on the 80286 and 80386 
Interpreting Encodings 
Interpreting 80386 Encoding Extensions 
80286 Encoding 
80386 Encoding 
Address-Size Prefix 
Operand-Size Prefix 
Encoding Differences for 32-bit Operations 
Scaled Index Base Byte 
Instructions 


Topical Cross-Reference 


Data Transfer String 
MOV MOVS 
MOVS LODS 
MOVSXS$ STOS 
MOVZXx5 SCAS 
XCHG CMPS 
LODS INS* 
STOS OUTS=* 
LEA REP 
LDS/LES REPE/REPZ 
LFS/LGS/LSS$ REPNE/REPNZ 
XLAT/XLATB 
Arithmetic 
Stack ADD 
PUSH ADC 
PUSHF INC 
PUSHA®* SUB 
POP SBB 
POPF DEC 
POPA* NEG 
IMUL 
Input/Output == MUL 
a” DIV 
Nee IDIV 
OUT 
OUTS* Logical 
AND 
Type 
Conversion XOR 
NOT 
CBW 
CWD 
oer — 
Cc S 
i ROR 
RCL 
Flag RCR 
CLC SHL/SAL 
CLD SHR 
CLI SAR 
CMC SHLD§ 
CLTS* SHRD§ 
STC BSF 
STD BSR§ 
STI 
POPF 
PUSHF 
LAHF 
SAHF 


* 80186/286/386 only. 


Compare 


CMP 
CMPS 
TEST 
BTi 
BTC? 
BTR? 
BTS§ 


Unconditional 
Lransfer 


CALL 

INT 

IRET 

RET 
RETN/RETF 


LOOP 
LOOPE/LOOPZ 
LOOPNE/LOOPNZ 
JCXZ/JECXZ 


Conditional 
iIransfer 


JB/JNAE 
JAE/JNB 
JBE/JNA 
JA/JNBE 
JE/JZ 
JNE/INZ 
JL/INGE 
JGE/JNL 
JLE/ING 
JG/JINLE 
JS 

JNS 


JNP/JPO 
JCXZ/JECXZ 
INTO 
BOUND* 


t 80286/386 only. 


Conditi E 
SETB/SETNAE$ 
SETAE/SETNB& 
SETBE/SETNA® 
SETA/SETNBE® 
SETE/SETZ$ 
SETNE/SETNZ§ 
SETL/SETNGES$ 
SETGE/SETNL® 
SETLE/SETNG§ 
SETG/SETNLE§ 
SETSS 
SETNS$ 

SETCS§ 
SETNCS8 
SETOS 
SETNO$S 
SETP/SETPES 
SETNP/SETPO$ 


AAA 
AAS 
AAM 
AAD 
DAA 
DAS 


Processor 


LAR* 
LGDT/LIDT/LLDT*t 
LMSW? 

LSL* 

LTR*t 
SGDT/SIDT/SLDTt 
SMSWt 

STRt 

VERRt 

VERW*t 

MOV special8 


§ 80386 only. 
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Interpreting Processor Instructions 


This section provides an alphabetical reference to the instructions for 
the 8086, 8088, 80286, and 80386 processors. A key to each element 
of the reference is giyen in Figure 1. 


Mnemonic Name Restriction (optional) 


BSF/BSR 


Bit Scan Flags 
80386 Only 
Scans an operand to find the first set bit. Ifa set bit is found, the zero 
flag is set and the destination operand is loaded with the bit index of the 
first set bil encountered. If no set bit is found. the zero Mag is cleared. Description 
BSF (Bit Scan Forward) scans from bit 0 to the most significant bit. 
BSR (Bit Scan Reverse) scans from the most significant bit of an 
operand to bit 0. 
Encoding 
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Syntax Examples Clock Speeds 


Figure 1 Instruction Key 


Flags 


The first row of the display has a one-character abbreviation for the flag 
name. Only the flags common to all processors are shown. 


O Overflow T Trap A Auxiliary carry 
D Direction S Sign P Parity 
I ‘Interrupt Z Zero C Carry 


The second line has codes indicating how the flag can be effected. 


Sets the flag 

Clears the flag 

May change the flag, but the value is not predictable 
lank No effect on the flag 

Modifies according to the rules associated with the flag 


Keoé_t Oo = 


PROCESSOR INTRODUCTION 23 


Syntax 

Each encoding variation may have different syntaxes corresponding to 
different addressing modes. The following abbreviations are used: 

reg A general-purpose register of any size 


segreg One of the segment registers: DS, ES, SS, or CS (also FS 
or GS on the 80386) 


accum An accumulator register of any size: AL or AX (also EAX 
on the 80386) 

mem A direct or indirect memory operand of any size 

label A labeled memory location in the code segment 

src,dest A source or destination memory operand used in a string 
operation 

immed A constant operand 


In some cases abbreviations have numeric suffixes to specify that the 
operand must be a particular size. For example, reg/6 means that only 
a 16-bit (word) register is accepted. 


Examples 


One or more examples are shown for each syntax. The examples are 
randomly chosen, and no significance should be attached to their order 
or placement. They are valid examples of the associated syntax, but 
there is no attempt to illustrate all possible operand combinations or to 
show context. Their position is not related to the clock speeds in the 
right column. 


To avoid confusion by programmers who do not have an 80386 
processor, examples do not use 32-bit registers unless the instruction is 
available only on the 80386. However, 80386 programmers can 
substitute 32-bit registers unless the description specifically states 
otherwise. 
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Clock Speeds 


Column 3 shows the clock speeds for each processor. Sometimes an 

instruction may have more than one clock speed. Multiple speeds are 
separated by commas. If several speeds are part of an expression, they 
will be enclosed in parentheses. The following abbreviations are used 
to specify variations: 


EA Effective address. This applies only to the 8088 and 8086 
processors, as described in the next section. 


Byte, word, or doubleword operands. 


pm Protected mode. 


n Iterations. Repeated instructions may have a base number of 
clocks plus a number of clocks for each iteration. For 


example, 8+4n means eight clocks plus four clocks for each 
iteration. 


noj No jump. For conditional jump instructions, noj indicates 
the speed if the condition is false and the jump is not taken. 


m Next instruction components. Some control transfer 
instructions take different times depending on the length of 
the next instruction executed. On the 8088 and 8086, m is 
never a factor. On the 80286, m is the number of bytes in 
the instruction. On the 80386, m is the number of 
components. Each byte of encoding is a component and the 
displacement and data are separate components. 


W88,88 8088 exceptions. See "Timings on the 8088 and 8086." 


Clocks can be converted to nanoseconds by dividing one microsecond 
by the number of megahertz (MHz) at which the processor is running. 
For example, on a processor running at 8 MHz, one clock takes 125 
nanoseconds (1000 MHz per nanosecond / 8 MHz). 


The clock counts are for best-case timings. Actual timings vary 
depending wait states, alignment of the instruction, the status of the 
prefetch queue, and other factors. 


Timings on the 8088 and 8086 


Because of its 8-bit data bus, the 8088 always requires two fetches to 
get a 16-bit operand. Instructions that work on 16-bit memory operands 
therefore take longer on the 8088 than on the 8086. Separate 8088 
timings are shown in parentheses following the main timing. For 
example, 9 (W88=13) means that the 8086 with any operands or the 
8088 with byte operands take 9 clocks, but the 8088 with word 
operands takes 13 clocks. Similarly, 16 (88=24) means that the 8086 
takes 21 clocks, but the 8088 takes 29 clocks. 
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On the 8088 and 8086, the effective address (EA) value must be added 
for instructions that operate on memory operands. A displacement is 


any direct memory or constant operand, or any combination of the two. 


Below are the number of clocks to add for the effective address. 


Components EA Clocks Examples 
Displacement 6 Mov ax, stuff 

mov ax, Stuff+2 
Base or index 5 mov ax, [bx] 

mov ax, [di] 
Displacement 9 mov ax, [bp+8] 
plus base or index mov ax, stuff [di] 
Base plus index 7 mov ax, [bx+si] 
(BP+DI,BX+SI) mov ax, (bptdi] 
Base plus index 8 Mov ax, [bx+di] 
(BP+SI,BX+DI) mov ax, (bpt+si) 
Base plus index 11 mov ax, stuff [(bx+si] 
plus displacement mov ax, (bp+di+8] 
(BP+DI+disp.BX+SI+disp) 
Base plus index 12 mov ax, stuff (bxtdi] 
plus displacement mov ax, [bp+sit+20] 
(BP+Sl+disp,BX+DlI+disp) 
Segment override EA+2 mov ax,es:stuff 

mov ax,ds: [bp+10) 


Timings on the 80286 and 80386 Processors 


On the 80286 and 80386 processors, the effective address calculation is 
handled by hardware and is therefore not a factor in clock calculations 
except in one case. If a memory operand includes all three possible 
elements—a displacement, a base register, and an index register—then 
add one clock. Examples are shown below. 


mov ax, [bx+di] ;No extra 
mov ax,array[bxt+di] ;One extra 
mov ax, [bx+dit6] ;One extra 


Note: 80186 and 80188 timings are different from 8088, 8086, and 
80286 timings. They are not shown in this manual. Timings are also 
not shown for protected-mode transfers through gates or for the virtual 
8086 mode available on the 80386 processor. 
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interpreting Encodings 


Encodings are shown for each variation of the instruction. This section 
describes encoding for all processors except the 80386. The encodings 
take the form of boxes filled with Os and |s for bits that are constant 
for the instruction variation, and abbreviations (in italics) for the 
following variable bits or bitfields: 


d 


rT€2 


Direction bit. If set, do memory to register or register to 
register; the reg field is the destination. If cleared, do 
register to memory; the reg field is the source. 


Word/byte bit. If set, use 16-bit operands. If cleared, use 8- 
bit operands. 


Sign bit. If set, sign-extend 8-bit immediate data to 16 bits. 


Mode. This two-bit field gives the register/memory mode 
with displacement. The possible values are shown below. 


mod Meaning 
00 This value can have two meanings: 
If r/m 1s 110, a direct memory operand ts used. 


If r/m is not 110, the displacement 1s 0 and an 
indirect memory operand is used. The operand must 
be based, indexed, or based indexed. 


01 An indirect memory operand is used with an 8-bit 
displacement. 

10 An indirect memory operand is used with a 16-bit 
displacement. 

11 A two-register instruction is used; the reg field 
specifies the destination and the r/m field specifies 
the source. 


Register. This three-bit field specifies one of the general- 
purpose registers: 


reg 16-bit if w=1 8-bit if w=0 
000 AX AL 
001 CX CL 
010 DX DL 
011 BX BL 
100 SP AH 
101 BP CH 
110 SI DH 
111 DI BH 


The reg field is sometimes used to specify encoding 
information rather than a register. 
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sreg 


rim 


disp 


Segment register. This field specifies one of the segment 
registers. 


sreg Register 


000 + +#«ES : 
001 cs | 
010 #SS 
011 DS 


Register/memory. This three-bit field specifies a memory or 
register operand. 


If the mod field is 11, r/m specifies the source register using 
the reg field codes. Otherwise, the field has one of the 
following values: 


rim Operand Address 
000 DS:[BX+SI+disp] 
001 DS:[BX+DI+disp] 
010 SS:[BP+SI+disp] 
011 SS:[BP+DI+disp] 
100 DS:[SI+disp] 

101 DS:[DI+disp} 

110 DS:[BP+disp]* 
111 DS:[BX+disp] 


Displacement. These bytes give the offset for memory 
operands. The possible lengths (in bytes) are shown in 
parentheses. 


Data. These bytes gives the actual value for constant values. 
The possible lengths (in bytes) are shown in parentheses. 


If a memory operand has a segment override, the entire instruction has 
one of the following bytes as a prefix: 


Segment 
CS 
DS 
ES 
SS 


Prefix 

00101110 (2Eh) 
00111110 (3Eh) 
00100110 (26h) 
00110110 (36h) 


* If mod is 00 and rim is | 10, then the operand is treated as a direct memory operand. This means that 
the operand (BP) is encoded as [BP+0] rather than having a short-form like other register indirect 
operands. Encoding [BX] takes one byte, but encoding [BP] takes two. 
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Mm Example 


As an example, assume you want to calculate the encoding for the 
following statement (where warray Is a 16-bit variable): 


add warray[bx+di],-3 


First look up the encoding for the immediate to memory syntax of the 
ADD instruction: 


ee. | ee 


Since the destination is a word operand, the w bit will be set. The 8-bit 
immediate data must be sign-extended to 16 bits in order to fit into the 
operand, so the s bit is also set. The first byte of the instruction 1s 
therefore 10000011 (83h). 


Since the memory operand can be anywhere in the segment, it must 
have a 16-bit offset (displacement). Therefore the mod field is 10. The 
reg field is 000, as shown in the encoding. The r/m coding for 
{[bx+di+disp] is 001. The second byte is 10000001 (81h). 


The next two bytes are the offset of warray. The high byte of the 
offset is stored first and the low byte second. For this example, assume 
that warray is located at offset 1OEFh 


The last byte of the instruction is used to store the 8-bit immediate 
value -3 (FDh). This value is encoded as 8 bits (but sign-extended to 16 
bits by the processor). 


The encoding is shown below in hexadecimal: 


83 81 10 EF FD 


You can confirm this by assembling the instruction and looking at the 
resulting assembly listing. 


Interpreting 80386 Encoding Extensions 


This manual shows 80386 encodings for instructions that are available 
only on the 80386 processor. For other instructions, encodings are 
shown only for the 16-bit subset available on all processors. This 
section tells how to convert the 80286 encodings shown in the manual 
to 80386 encodings that use extensions such as 32-bit registers and 
memory operands. 


The extended 80386 encodings differ in that they can have additional 
prefix bytes, a Scaled Index Base (SIB) byte, and 32-bit displacement 
and immediate bytes. Use of these elements is closely tied to the 
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segment word size. The use type of the code segment determines 
whether the instructions are processed in 32-bit mode (USE32) or 16- 
bit mode (USE16). Current versions of MS-DOS® and announced 
versions of OS/2 use 16-bit mode only. 


The bytes that can appear in an instruction encoding are shown below. 


disp inuned 
(0-2) (0-2) 


80286 Encoding 
rim 
(1-2) (0-1) 
80386 Encoding 


Address Operand 


Size (67h) 


- - Opcode mod-reg- Scaled disp immed 
Size (66h) rim Index Base 
(0-1) (0-1) (1-2) (0-1) (0-1) (0-4) (0-4) 


Additional bytes may be added for a segment prefix, a repeat prefix, or 
the LOCK prefix. 


Address-Size Prefix 


The address-size prefix determines the segment word size of the 
operation. It can override the default size for calculating the 
displacement of memory addresses. The address prefix byte is 67h. 
MASM automatically inserts this byte where appropriate. 


In 32-bit mode (USE32 code segment), displacements are calculated as 
32-bit addresses. The effective address-size prefix must be used for any 
instructions that must calculate addresses as 16-bit displacements. In 
16-bit mode the defaults are reversed. The prefix must be used to 
specify calculation of 32-bit displacements. 


Operand-Size Prefix 


The operand-size prefix determines the size of operands. It can override 
the default size of registers or memory operands. The operand-size 
prefix byte is 66h. MASM automatically inserts this byte where 
appropriate. 


In 32-bit mode, the default sizes for operands are 8 bits and 32 bits 
(depending on the w bit). The operand-size prefix must be used for any 
instructions that use 16-bit operands. In 16-bit mode, the default sizes 
are 8 bits and 16 bits. The prefix must be used for any instructions that 
use 32-bit operands. 
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Encoding Differences for 32-bit Operations 


When 32-bit operations are performed, the meaning of certain bits or 
fields are different than for 16-bit operations. The changes may affect 
default operations in 32-bit mode, or 16-bit mode operations in which 
the address-size prefix or the operand-size prefix is used. The following 
fields may have a different meaning for 32-bit operations than the 
meaning described in the Interpreting Encodings section: 


Ww 


reg 


sreg 


rim 


disp 


Word/byte bit. If set, use 32-bit operands. If cleared, use 8- 
bit operands. 


Sign bit. If set, sign-extend 8-bit or 16-bit immediate data 
to 32 bits. 


Mode. This field indicates the register/memory mode. The 
value 11 still indicates a register-to-register operation with 
r/m containing the code for a 32-bit source register. 
However, other codes have different meanings as shown in 
the tables in the next section. 


Register. The codes for 16-bit registers are extended to 32- 
bit registers. For example, if the reg field is 000, EAX is 
used instead of AX. Use of 8-bit registers is unchanged. 


Segment register. The 80386 has the following additional 
segment registers: 


sreg Register 

100 FS 

101 GS 

Register/memory. If the r/m field is used for the source 


register, 32-bit registers are used as for the reg field. If the 
field is used for memory operands, the meaning is 
completely different than for 16-bit operations, as shown in 
the tables in the next section. 


Displacement. This field is four bytes for 32-bit addresses. 


Data. Immediate data can be up to four bytes. 
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Scaled index Base Byte 


Many 80386 extended memory operands are too complex to be 
represented by a single mod-reg-r/m byte. For these operands, a value 
of 100 in the r/m field signals the presence of a second encoding byte 
called the Scaled Index Base (SIB) byte. The SIB byte is made up of the 


following fields: 
SS Scaling Field. This two-bit field specifies one of the 
following scaling factors: 
SS Factor 
00 l 
01 2 
10 4 
11 8 
index Index Register. This three-bit field specifies one of the 
following index registers: 
index Register 
000 EAX 
001 ECX 
010 EDX 
011 EBX 
100 no index 
101 EBP 
110 ESI 
111 EDI 


Note that ESP cannot be an index register. If the index field 
is 100, then the ss field must be 00. 


base Base Register. This three-bit field combines with the mod 
field to specify the base register and the displacement. Note 
that the base field only specifies the base when the r/m field 
is 100. Otherwise the r/m field specifies the base. 
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The possible combinations of the mod, r/m, scale, index, and base 
fields are shown below. 


Fields for 32-bit 
Nonindexed Operands 


Fields for 32-bit 
Indexed Operands 


mod rim Qperand mod rim base Operand 

00 000 DS:[EAX] 00 100 000 DS:{EAX+(scale*index)] 
00 OO| DS:[ECX] 00 100 001 DS:([ECX+(scaletindex)]} 
00 O10 DS:{EDX] 00 100 010 DS:[EDX+(scale*index)] 
00 O11 DS:{EBX] 00 100 011 DS:[EBX+(scale*inde.x)] 

00 100 SIB used 00 100 100 SS:[ESP+(scale*index)} 

00 101) = DS:disp32t 00 100 101 DS:[disp32+(scale*index)]t 
00 110 DS:{EST] 00 100 110 DS:{ESI+(scale*index)] 

00 111 DS:({EDIT] 00 100 111 DS:[EDI+(scale*inde.x)] 


0! 000 DS:{EAX+disp8}] 
DS:([ECX+disp8] 
0! 010 DS:{EDX+disp8} 
DS:([EBX+disp8} 
01 100 SIB used 
SS:([EBP+disp8] 
01 110 DS:{ESI+disp8] 
DS:[EDI+disp8] 


O! 100 000 DS:[EAX+(scale*index)+disp8] 
01 100 001 DS:[ECX+(scale*index)+disp8] 
0! 100 010 DS:[EDX+(scale*index)+disp8) 
01 100 O11 DS:[EBX+(scaletindex)+disp8] 
O! 100 100 SS:[ESP+(scale*index)+disp8] 
O01 100 101 SS:{EBP+(scale*index)+disp8] 
0! 100 110 DS:{ESI+(scale*index)+disp8}] 
O01 100 f11 DS:[EDI+(scale*index)+disp8} 


10 000 DS:{EAX+disp32] 
DS:[ECX+disp32] 
10 010 DS:[EDX+disp32] 
DS:[EBX+disp32] 
10 100 SIB used 
SS:([EBP+disp32} 
10 110 DS:[ESI+disp32] 
10) 112) =DS:[EDI+disp32] 


10 100 000 DS:{EAX+(scale*index)+disp32] 
10 100 O00t DS:[ECX+(scale*index)+disp32] 
10 §=100 010 DS:[EDX+(scale*index)+disp32} 
10 §=6©=100 O11 DS:[EBX+(scaletindex)+disp32] 
10 100 100 SS:{ESP+(scale*index)+disp32] 
10 100 101 SS:(EBP+(scale*index)+disp32) 
10 §=©100 110 DS:[ESI+(scale*index)+disp32} 
10 §=100 III DS:[EDI+(scale*index)+disp32] 


+ The operand {EBP] must be encoded as [EBP+0) (the O is an 8-bit displacement). 
Similarly, [EBP+(scale*index)] must be encoded as [EBP+(scale*index)+0). The short 
encoding form available with other base registers cannot be used with EBP. 


If a memory operand has a segment override, the entire instruction has 
one of the prefixes discussed earlier in the Interpreting Encodings 
section or one of the following prefixes for the segment registers 
available only on the 80386: 


Segment Prefix 
FS 01100100 (64h) 
GS 01100101 (65h) 
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M@ Example 


Assume you want to calculate the encoding for the following statement 
(where warray is a 16-bit variable). Assume also that the instruction 
is used in 16-bit mode. 


add warray [eaxtecx*2],-3 


First look up the encoding for the immediate to memory syntax of the 
ADD instruction: 


disp (0 or 2) data (1 or 2) 


This encoding must be expanded to account for 80386 extensions. Note 
that the instruction operates on 16-bit data in a 16-bit mode program. 
Therefore, the operand-size prefix is not needed. However, the 
instruction does use 32-bit registers to calculate a 32-bit effective 
address. Thus the first byte of the encoding must be the effective 
address-size prefix, 01100111 (67h). 


The opcode byte is the same (83h) as for the 80286 example described 
in the Interpreting Encodings section. 


The mod-reg-r/m byte must specify a based indexed operand with a 
scaling factor of two. This operand cannot be specified with a single 
byte, so the encoding must also use the SIB byte. The value 100 in the 
rim field specifies an SIB byte. The reg field is 000, as shown in the 
encoding. The mod field is 10 for operands that have base and scaled 
index registers and a 32-bit displacement. The combined mod, reg, and 
r/m fields for the second byte are 10000100 (84h). 


The SIB byte is next. The scaling factor is 2, so the ss field is 01. The 
index register is ECX, so the index field is 001. The base register is 
EAX, so the base field is 000. The SIB byte is 01001000 (48h). 


The next four bytes are the offset of warray. The low bytes are stored 
last. For this example, assume that warray is located at offset 
1OEFh. This offset only requires two bytes, but four must be supplied 
because of the addressing mode. A 32-bit address can be safely used in 
16-bit mode as long as the upper word is 0. 


The last byte of the instruction is used to store the 8-bit immediate 
value -3 (FDh). 


The encoding is shown below in hexadecimal: 


67 83 84 48 00 00 10 EF FD 
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AAA 
BER RMB 


ASCIi Adjust After Addition 


Adjusts the result of an addition to a decimal digit (0-9). The previous 
addition instruction should place its 8-bit sum in AL. If the sum is 
greater than 9h, AH is incremented and the carry and auxiliary carry 
flags are set. Otherwise, the carry and auxiliary carry flags are cleared. 


O(DIT ITI SIZ AlPIC 


AAD 
BERR BABE 


ASCII Adjust Before Division 


Converts unpacked BCD digits in AH (most significant digit) and AL 
(least significant digit) to a binary number in AX. The instruction is 
often used to prepare an unpacked BCD number in AX for division by 
an unpacked BCD digit in an 8-bit register. 
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AAM 
ASCIl Adjust After Multiply 
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Converts an 8-bit binary number less than 100 decimal in AL to an 
unpacked BCD number in AX. The most significant digit goes in AH | 
and the least significant in AL. This instruction is often used to adjust 


the product after a MUL instruction that multiplies unpacked BCD 
digits in AH and AL. It is also used to adjust the quotient after a DIV 
instruction that divides a binary number less than 100 decimal in AX 
by an unpacked BCD number. 


11010100 00001010 
88/86 83 
AAM 286 16 


AAS 
ASCII Adjust 
After Subtraction 


Adjusts the result of a subtraction to a decimal digit (0-9). The 
previous subtraction instruction should place its 8-bit result in AL. If 
the result is greater than 9h, then AH is decremented and the carry and 
auxiliary carry flags are set. Otherwise, the carry and auxiliary carry 
flags are cleared. 
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ADC 
Add with Carry 


Adds the source operand, the destination operand, and the value of the 
carry flag. The result is assigned to the destination operand. This 


instruction is used to add the more significant portions of numbers that 
must be added in multiple registers. 


adc dx,cx 88/86 = 3 
ADC reg,reg 286 2 
clea ane fe NE 
adc WORD PTR m32[(2],dx 88/86 16G+EA (W88=24+EA) 
ADC mem.reg 286 =—7 
ee te 
adc dx,WORD PTR m32(2]) 88/86 9+EA (W88=13+EA) 
= 
386 6 


ade dx,12 88/86 4 
ae a 
386 2 
sD¢ meminmed adc WORD PTR m32[(2],16 | 88/86 17+EA (W88=23+EA) 
ADC mem,immed 286 7 
| = 386 7 


disp (0 or 2) 


disp (0 or 2) data (1 or 2) 


adc ax,5 88/86 4 
ADC accum,immed 286 3 
386 2 


data (I or 2) 
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ODERABARE 
FS ES ES ES EES 


ADD 
Add 


Adds the source and destination operands and puts the sum in the 
destination operand. 


add ax,bx 88/86 3 
286 2 
386 2 
add total,cx 88/86 16+EA (W88=24+EA) 
ADD mem,reg add array [bx+di],dx 286 «7 
386 7 
add cx,incr 88/86 9+EA (W88=13+EA) 
ADD reg.mem add dx, (bp+6] 286 7 
6 


data (I or 2) 


disp (0 or 2) 


mod, 000,r/m 


add bx, 6 88/86 4 
386 862 
add amount, 27 88/86 17+EA (W88=23+EA) 
ADD mem,immed add pointers(bx) (si],6 286 3=—7 
386 7 


add ax,10 
ADD accum,immed 


disp (0 or 2) 


data (I or 2) 
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AND 
ot [ T fet+] 7] +] 0) 


Logical AND 


Performs a bitwise logical AND on the source and destination operands 
and stores the result in the destination operand. For each bit position in 
the operands, if both bits are set, then the corresponding bit of the 
result is set. Otherwise, the corresponding bit of the result is cleared. 


CC dsp 002) 


and = dx,bx 88/86 83 
AND reg.reg 286 82 
386 =2 
and  bitmask,bx 88/86 16+EA (W88=24+EA) 
AND mem,reg and [bp+2Z},dax 286 7 
386 7 


and  bx,masker 88/86 9+EA (W88=13+EA) 
AND reg,mem and  dx,marray([bx+di) 286 7 
6 


386 


disp(Oor2) — data(! or2) 


and ax, OF 7h 
AND reg,immed 


data (1 or 2) 
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ARPL 


Adjust Requested 
Privilege Level 
80286/386 Protected Only 


Verifies that the destination Requested Privileged Level (RPL) field 
(bits 0 and 1 of a selector value) is less than the source RPL field. If it 
is not, ARPL adjusts the destination RPL up to match the source 
RPL. The destination operand should be a 16-bit memory or register 
operand containing the value of a selector. The source operand should 
be a 16-bit register containing the test value. The zero flag is set if the 
destination is adjusted; otherwise the flag is cleared. ARPL can only 
be used in 80286 and 80386 privileged mode. See Intel documentation 
for details on selectors and privilege levels. 


01100011 disp (0 or 2) 


arpl ax,cx 88/86 3 — 
ARPL reg,reg 286 =—s:110 
386 =. 20 


arpl selector,dx 88/86 — 
ARPL mem,reg 286 11 
386 = ss 21 
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BOUND 


Check Array Bounds 
80186/286/386 Only 


Verifies that a signed index value is within the bounds of an array. The 
destination operand can be any 16-bit register containing the index to 
be checked. The source operand must then be a 32-bit memory operand 
in which the low and high words contain the starting and ending 
values, respectively, of the array. (On the 80386 processor, the 
destination operand can be a 32-bit register; in this case, the source 
operand must be a 64-bit operand made up of 32-bit bounds.) If the 
source operand is less than the first bound or greater than the last 
bound, then an Interrupt 5 is generated. The instruction pointer pushed 
by the interrupt (and returned by IRET) points to the BOUND 
instruction rather than to the next instruction. 


01100010 


i (2) 


BOUND reg/6,mem32 | bound di,base-4 88/86 — 
BOUND reg32,mem64* 286 noj=13t 
386 noj=10T 


* 80386 only. 
t See INT for timings if interrupt 5 is called. 
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BSF/BSR 


Bit Scan 
80386 Only 


Scans an operand to find the first set bit. If a set bit is found, the zero 
flag is set and the destination operand is loaded with the bit index of the 
first set bit encountered. If no set bit is found, the zero flag is cleared. 
BSF (Bit Scan Forward) scans from bit 0 to the most significant bit. 
BSR (Bit Scan Reverse) scans from the most significant bit of an 
operand to bit 0. 


000011 11 [ mod, reg, rim disp (0, 2, or 4) 


BSF reg/6,reg]6 bsf Cx, Dx 
BSF reg32,reg32 
BSF reg/6,mem16 bsf ecx,bitmask — 


BSF reg32,mem32 286 
386 


disp (0, 2, or 4) 


OOTTT 


BSR reg/6,reg/6 
BSR reg32,reg32 


BSR reg!l6,mem!6 bsr eax, bitmask — 
BSR reg32,nem32 260 — 
386 
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BT/BTC/BTR/BTS 


Bit Tests 
80386 Only 
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Copies the value of a specified bit into the carry flag where it can be 
tested by a JC or JNC instruction. The destination operand specifies 
the value in which the bit is located; the source operand specifies the 
bit position. BT simply copies the bit to the flag. BTC copies the bit 
and complements (toggles) it in the destination. BTR copies the bit 
and resets (clears) it in the destination. BTS copies the bit and sets it 
in the destination. 


00001111 mod, BBB*.rim | __ disp (0, 2, or 4) 


bt ax, 4 88/86 — 
BT reg!6,i:nmed8+ 286 — 
386 3 
86 


BTC reg16.immed8t bts ax,4 88/86 — 

BTR reg/6,immed8+ btr bx,17 2 
BTS reg/6,immed8&t btc edi,4 386 866 

btr DWORD PTR [siJ,27 88/86 —_ 

BT mem!6,immed8t btc color{di],4 286 — 
386 = «6 

BTC mem!/6,immed8t btc DWORD PTR (bx),27 88/86 — 

BTR mem!/6,immed8&t btc maskit, 4 236 — 
BTS mem!/6,immed8+ btr color(di),4 386 8 


OOOOL 111 108BB011* mod, reg, rim disp (0, 2, or 4) 


bt ax, bx 


BT reg/6,reg!6t 

BTC reg/6,reg/6t btc eax,ebx 

BTR reg/l6,reg/6t bts bx,ax 

BTS reg/6,reg/6+ btr cx,di 

BT mem]/6,reg/16t 

BTC mem!6,reg!l6t bts flags{bx),cx 


BTR mem!/6,reg/6t btr rotate,cx 
BTS mem!6,reg/6t btc [bp+8],si 


* BBB is 100 for BT, 111 for BTC, 110 for BTR, and 101 for BTS. 
+ Operands can also be 32 bits (reg32 and mem32). 
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CALL 


Call Procedure 


Ol; Di {T{s{ZlalPic 
pte tt ET 


Calls a procedure. The instruction does this by pushing the address of 
the next instruction onto the stack and transferring to the address 
specified by the operand. For NEAR calls, SP is decreased by 2, the 
offset (IP) is pushed, and the new offset is loaded into IP. 


For FAR calls, SP is decreased by 2, the segment (CS) is pushed, 
and the new segment is loaded into CS. Then SP is decreased by 2 
again, the offset (IP) is pushed, and the new offset is loaded into IP. A 
subsequent RET instruction can pop the address so that execution 
continues with the instruction following the call. 


disp (2) 


call upcase 88/86 19 (88=23) 
CALL label 286 7+m 
a ; , eae eae it 


10011010 disp (4) 


call FAR PTR job 88/86 28 (88=36) 
CALL label call distant 286 3 =$13+m,pm=26+m* 
, RE eal alti 


call ax 88/86 16 (88=20) 
CALL reg 286 7+m 
386 7+m 
CALL mem!6 call pointer 88/86 21+EA (88=29+EA) 
CALL mem32t call [bx] 286 L1+m 
386 10+m 


CALL mem32 call far _table[di} 88/86 37+EA (88=53+EA) 
CALL mem48t call DWORD PTR [bx] 286 16+m,pm=29+m* 
386 22+m,pm=38+m* 


* Timings for calls through call and task gates are not shown, since they are used primanily in 
operating systems. 


¢ 80386 32-bit addressing mode only. 
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CBW 
Convert Byte to Word 


O| Dit {T{S{Z} al Plc 
al aes es pesto 


Converts a signed byte in AL to a signed word in AX by extending 
the sign bit of AL into all bits of AH. 


* CBW and CWDE have the same encoding dap that in 32-bit mode CBW is peed by the 
operand-size byte (66h) but CWDE is not; in | 
byte but CBW is not. 


bit mode CWDE is preceded by the operand-size 


CDQ 
Convert Double to Quad 
80386 Only 


Converts the signed doubleword in EAX to a signed quadword in the 
EDX:EAX register pair by extending the sign bit of EAX into all 
bits of EDX. 


1001 1001* 
cdq 88/86. — 
CDQ 286°. a 


* CWD and CDQ have the same encoding except that in 32-bit mode CWD is preceded by the 
poe aa iee byte (66h) but CDQ is not; in 16-bit mode CDQ is preceded by the operand-size byte 
{ 1s not. 
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CLC 
Clear Carry Flag 


Clears the carry flag. 


CLD 


Clear Direction Flag 


OD RHABAR 
Usa az 


Clears the direction flag. All subsequent string instructions will 
process up (from low addresses to high addresses), by increasing the 
appropriate index registers. 
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CLI 
Clear Interrupt Flag 


Clears the interrupt flag. When the interrupt flag is cleared, maskable 
interrupts are not recognized until the flag is set again with the STI 
instruction. In privileged mode, CLI only clears the flag if the current 
task's privilege level is less than or equal to the value of the IOPL flag. 
Otherwise, a general protection fault is generated. 


CLTS 


Clear Task Switched Flag 
80286/386 Privileged Only 


Clears the task switched flag in the Machine Status Word (MSW) of 
the 80286 or the CRO register of the 80386. This instruction can be 
used only in systems software executing at privilege level 0. See Intel 
documentation for details on the task switched flag and other privileged- 
mode concepts. 
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CMC 
Complement Carry Flag 


Complements (toggles) the carry flag. 
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CMP 


Compare Two Operands 


olpii | T}s[zfalPpic 


Compares two operands as a test for a subsequent conditional jump or 
set instruction. CMP does this by subtracting the source operand from 
the destination operand and setting the flags according to the result. 
CMP is the same as the SUB instruction, except that the result is not 
stored. 


disp (0 or 2) 


COMI 


cmp di, bx 88/86 3 
CMP reg,reg cmp dl,cl 286 2 
386 2 
cmp maximum, dx 88/86 9+EA (W88=13+EA) 
286 7 
386 = 5 


CMP mem,reg cmp array([(sij),bl 


cmp ax,minimum 88/86 9+EA (W88=13+EA) 
CMP reg,mem cmp  bh,array([si] 286 866 
386_6 


mod, 111,r/m 


cmp ax,24 88/86 4 
wom [et 
386 2 
cmp WORD PTR [(di],4 88/86 10+EA (W88=14+EA) 
cmp tester, 4000 286 866 
386 3865 


data} 02) 


disp (0 or 2) data (I or 2) 


cmp ax,1000 88/86 4 
CMP accum,immed 286 3 
386 2 
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CMPS/CMPSB/ 


CMPSW/CMPSD 
Compare String 


Compares two strings. DS:SI must point to the source string and 
ES:DI must point to the destination string (even if operands are 
given). For each comparison, the destination element is subtracted from 
the source element and the flags are updated to reflect the result 
(although the result 1s not stored). DI and SI are adjusted according to 
the size of the operands and the status of the direction flag. They are 
increased if the direction flag has been cleared with CLD or decreased if 
the direction flag has been set with STD. 


If the CMPS form of the instruction is used, operands must be 
provided to indicate the size of the data elements to be processed. A 
segment override can be given for the source (but not for the 
destination). If CMPSB (bytes), CMPSW (words), or CMPSD 
(doublewords on the 80386 only) is used, the instruction determines the 
size of the data elements to be processed. Operands are not allowed. 


CMPS and its variations are usually used with repeat prefixes. 
REPNE (or REPNZ) is used to find the first match between two 
strings. REPE (or REPZ) is used to find the first nonmatch. Before 
the comparison, CX should contain the maximum number of elements 
to compare. After the comparison, CX will be 0 if no match (for 
REPNE) or no nonmatch (for REPE) was found. Otherwise SI and 
DI will point to the element after the first match or nonmatch. 


eas aoe Jsrc,[ES:]Jdest | cmps  source,es:dest 88/86 “ (W88=30) 
repne cmpsw 286 
Gin repe cmpsb 386 
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CWD 


Convert Word to Double 


ol Dit {TI s{Z{AlP{c 
be sede a 


Converts the signed word in AX to a signed word in the DX:AX 
register pair by extending the sign bit of AX into all bits of DX. 


10011001* 


* CWD and CDQ have the same encoding ex ey that in 32-bit mode CWD is preceded by the 
phere ize Dy! byte (66h) but CDQ is not; in 16-bit mode CDQ is preceded by the operand-size byte 
ut is not. 


CWDE 


Convert Word to 
Extended Double 
80386 Only 


Converts a signed word in AX to a signed doubleword in EAX by 
extending the sign bit of AX into all bits of EAX. 


Peon PO MMOS NIZE ION MELA ITP MNM MENA NAIA aN faa LP MGT ONAN PMN SLOMAN aby UMGPMIVIA NN tatoo SUS INI 
: 


* CBW and aide have the same encoding except that in 32-bit mode CBW is Lage receded by the 
y 


operand-size byte (66h) but CWDE is not; in 16-bit mode CWDE is preceded 


the operand-size 
byte but CBW is not. 
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DAA 
Decimal Adjust After Addition 


O} DIT | TIs{ZlAl Plc) 
52 ES ES ESSE 


Adjusts the result of an addition to a packed BCD number (less than 
100 decimal). The previous addition instruction should place its 8-bit 
binary sum in AL. DAA converts this binary sum to packed BCD 
format with the least significant decimal digit in the lower four bits and 
the most significant digit in the upper four bits. If the sum is greater 
than 99h after adjustment, then the carry and auxiliary carry flags are 
set. Otherwise, the carry and auxiliary carry flags are cleared. 


00100111 
88/86 4 
DAA 286 83 
386 4 


DAS 


Decimal Adjust 
after Subtraction 


Adjusts the result of a subtraction to a packed BCD number (less than 
100 decimal). The previous subtraction instruction should place its 8- 
bit binary result in AL. DAS converts this binary sum to packed 
BCD format with the least significant decimal digit in the lower four 
bits and the most significant digit in the upper four bits. If the sum is 
greater than 99h after adjustment, then the carry and auxiliary carry 
flags are set. Otherwise, the carry and auxiliary carry flags are cleared. 
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O| DIT {Tis Zl Alpi Cc 


| DEC 
it] TT peti ti et 


Decrement 


Subtracts 1 from the destination operand. Because the operand is treated 
as an unsigned integer, the DEC instruction does not affect the carry 
flag. If a signed borrow requires detection, use the SUB instruction. 


disp (0 or 2) 


88/86 3 
286 2 
386 2 
counter ee en (W88=23+EA) 
386 6 ae 


01001 reg 


DEC reg/6 dec ax 88/86 3 
DEC reg32* 286 2 
386 2 


* 80386 only. 
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O{DIT {TI S{Z}AalPlc 


DIV 
BEER 


Unsigned Divide 


Divides an implied destination operand by a specified source operand. 
Both operands are treated as unsigned numbers. If the source (divisor) is 
16 bits wide, then the implied destination (dividend) is the DX:AX 
register pair. The quotient goes into AX and the remainder into DX. If 
the source is 8 bits wide, the implied destination operand is AX. The 
quotient goes into AL and the remainder into AH. On the 80386, if 
the source is EAX, the quotient goes into EAX and the divisor into 
D 


ais (002) 
b=80-90,w=144-162 
b=14,w=22 
b=14,w=22,w=38 


div [bx] (b=86-96,w=150-168)+EA* 
b=17,w=25 
b=17,w=25,d=41 


DIV mem div fsize 


div cx 
DIV reg div dl 


* Word memory operands on the 8088 take (158-176)+EA clocks. 
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ENTER 


Make Stack Frame 
80186/286/386 Only 


Creates a stack frame for a procedure that receives parameters passed on 
the stack. The BP register is pushed and BP is set as the stack frame 
through which parameters and local variables can be accessed. The first 
operand of the ENTER instruction specifies the number of bytes to 
reserve for local variables. The second operand specifies the nesting 
level for the procedure. The nesting level should be 0 for languages that 
do not allow access to local variables of higher level procedures (such 
as C, BASIC, and FORTRAN). See the complementary instruction 
LEAVE for a method of exiting from a procedure. 


data (2) data (1) 


enter 4,0 88/86 — 
386 10 
enter 0,1 88/86 —_ 
ENTER immed!6,1 286 15 
386 12 
enter 6,4 88/86 — 
ENTER immed!6,immed8& 286 12+4(n-1) 
386 15+4(n-1) 
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ESC 


Escape 


Oj DIT TT] sz} Alp] c) 
Roe alee estes 


Provides an instruction, and optionally a memory or register operand, 


for use by a coprocessor (such as the 8087, 80287, or 80387). The first 
operand must be a 6-bit constant that specifies the bits of the 
coprocessor instruction. The second operand can be either a register or 
memory operand to be used by the coprocessor instruction. The CPU 
puts the specified information on the data bus where it can be accessed 
by the coprocessor. MASM automatically inserts ESC instructions 
in coprocessor instructions. 


L1O1LTTT* mod, LLL* sim 


esc 5,al 88/86 2 
ESC immed,reg 286 9-20 


esc 29, [bx] 88/86 8+EA (W88=12+EA) 
ESC immed,mem 286 9-20 
386— srt 


* TTT specifies the top three bits of the coprocessor opcode and LLL specifies the lower three bits. 
t Timings vary. See the 80387 timings in the coprocessor section. 


HLT 
Halt 


O[DIT {TI SIZ{AlPIC 
Les De 


Stops CPU execution until an interrupt restarts execution at the 
instruction following HLT. 
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IDIV 
Signed Divide 


Ol] DIT {TIS |Z} alPic 
2th et er 2 


Divides an implied destination operand by a specified source operand. 
Both operands are treated as signed numbers. If the source (divisor) 1s 
16 bits wide, then the implied destination (dividend) is the DX:AX 
register pair. The quotient goes into AX and the remainder into DX. If 
the source is 8 bits wide, the implied destination is AX. The quotient 
goes into AL and the remainder into AH. On the 80386, if the source 
is EAX, the quotient goes into EAX and the divisor into EDX. 


disp (0 or 2) 


LILIOLIw mod, \11,r/m 


b=101-112,w=165-184 

b=17 ,w=25 

b=19,w=27 ,d=43 
(b=107-118,w=171-190)+EA* 
b=20,w=28 

b=22,w=30,d=46 


| idiv bx 
IDIV reg div dl 
| idiv itemp 
IDIV mem 


* Word memory operands on the 8088 take (175-194)+EA clocks. 
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IMUL 
Signed Multiply 


Multiplies an implied destination operand by a specified source 
operand. Both operands are treated as signed numbers. If a single 16-bit 
operand is given, the implied destination is AX and the product goes 
into the DX:AX register pair. If a single 8-bit operand is given, the 
implied destination is AL and the product goes into AX. On the 
80386, if the operand is EAX, the product goes into the EDX:EAX 
register pair. The carry and overflow flags are set if the product is sign 
extended into DX for 16-bit operands, into AH for 8-bit operands, or 
into EDX for 32-bit operands. 


Two additional syntaxes are available on the 80186-80386 processors. 
In the two-operand form, a 16-bit register gives one of the factors and 
serves as the destination for the result; a source constant specifies the 
other factor. In the three-operand form, the first operand is a 16-bit 
register where the result will be stored, the second is a 16-bit register or 
memory operand containing one of the factors, and the third is a 
constant representing the other factor. With both variations, the 
overflow and carry flags are set if the result is too large to fit into the 
16-bit destination register. Since the low 16 bits of the product are the 
same for both signed and unsigned multiplication, these syntaxes can 
be used for either signed or unsigned numbers. On the 80386, the 
operands can either 16 or 32 bits wide. 


A fourth syntax is available on the 80386. Both the source and 
destination operands can be given specifically. The source can be any 
16- or 32-bit memory operand or general-purpose register. The 
destination can be any general-purpose register of the same size. The 
overflow and carry flags are set if the product does not fit in the 
destination. 


disp (0 or 2) 


b=80-98 w=1 28-154 
b=13,w=21 

b=9- 14, w=9-22,d=9-38t 
(b=86-104,w=134-160)+EA* 
b=16,w=24 
b=12-17,w=12-25,d=12-41tf 


imul factor 
IMUL mem 
* Word memory operands on the 8088 take (138-164)+EA clocks. 


+ The 80386 has an early-out multiplication algorithm. Therefore multiplying an 8-bit or 16-bit value 
in EAX takes the same time as multiplying the value in AL or AX. 


CONTINUED... 
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disp(Oor2) ——data(I or 2) 


IMUL reg!l6,unmed imul cx,25 88/86 — 
IMUL reg32,immed* 286 21 
386 b=9-14,w=9-22,d=9-38t 


IMUL reg!6,reg!6,immed imul dx,ax,18 88/86 — 
IMUL reg32,reg32,immed* 286 21 
386 b=9-14,w=9-22,d=9-38t 
IMUL reg!l6,mem!16,immed imul bx, {si}, 60 88/86 — 
IMUL reg32,mem32,immed* 286 24 


386 _b=12-17,w=12-25,d=12-41t 


moO dsp 0r2 


IMUL reg/6,reg!6 imul cx,ax 
IMUL reg!/6,regl6 


IMUL regl6.meml6 imul dx, [si] — 
IMUL reg32,.mem32 286 — 
386 =w=12-25,d=12-41 


* 80386 only. 
t The variations depend on the source constant size; destination size is not a factor. 


IN 


Input from Port 


O] DIT | TIS{Z{A] PIC 
eae 


Transfers a byte or word (or doubleword on the 80386) from a port to 
the accumulator register. The port address is specified by the source 
operand, which can be DX or an 8-bit constant. Constants can only be 
used for ports numbers less than 255; use DX for higher port numbers. 
In privileged mode, a general protection fault is generated if IN is used 
when the current protection level is greater than the value of the IOPL 
flag. 


in ax, 60h 88/86 10 (W88=14) 
IN accum,immed 286 865 
12,pm=6,26* 


} 88/86 8 (W88=12) 
IN accum,DX i 286 5 
386 13,pm=7,27* 


* First protected-mode timing: CPL s IOPL. Second timing: CPL > IOPL. 
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INC 


Increment 


OT DIT {TIs| Zl A] PTC 
ty PT fet tet 


Adds | to the destination operand. Because the operand is treated as an 
unsigned integer, the INC instruction does not affect the carry flag. If a 
signed carry requires detection, use the ADD instruction. 


LLILL lw mod, 000,r/m disp (0 or 2) 


S+EA (W88=23+EA) 


* 80386 only. 
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INS/INSB/INSW/INSD 


Input from Port to String 
80186/286/386 Only 


Receives a string from a port. The string 1s considered the destination 
and must be pointed to by ES:DI (even if an operand is given). The 
input port is specified in DX. For each element received, DI is 
adjusted according to the size of the operand and the status of the 
direction flag. DI is increased if the direction flag has been cleared with 
CLD or decreased if the direction flag has been set with STD. 


If the INS form of the instruction is used, a destination operand must 
be provided to indicate the size of the data elements to be processed and 
DX must be specified as the source operand containing the port 
number. A segment override is not allowed. If INSB (bytes), INSW 
(words), or INSD (doublewords on the 80386 only) is used, the 
instruction determines the size of the data elements to be received. No 
operands are allowed. 


INS and its variations are usually used with the REP prefix. Before 
the repeated instruction is executed, CX should contain the number of 
elements to be received. In privileged mode, a general protection fault 
is generated if INS is used when the current protection level is greater 
than the value of the IOPL flag. 


INS [ES:}dest,DX rep  insb 88/86 
INSB ins es:instr,dx 286 
INSW rep insw 386 i: »pm=9,29* 


* First protected-mode timing: CPL < IOPL. Second timing: CPL > [OPL. 
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Oj} DIT {| T{s{Z/ Al Plc) 
Lt jojo] Tt tt 


INT 


Interrupt 


Generates a software interrupt. An 8-bit constant operand (0 to 255) 
specifies the interrupt procedure to be called. The call is made by 
indexing the interrupt number into the Interrupt Descriptor Table (IDT) 
starting at segment 0, offset 0. In real mode, the IDT contains 4-byte 
pointers to interrupt procedures. In privileged mode, the IDT contains 
8-byte pointers. When an interrupt is called in real mode, the flags, 
CS, and IP are pushed onto the stack (in that order) and the trap and 
interrupt flags are cleared. STI can be used to restore interrupts. See 
Inte] documentation and the documentation for your operating system 
for details on using and defining interrupts in privileged mode. To 
return from an interrupt, use the IRET instruction. 


gh 51 (88=71) 
23+m,pm=(40,78)+m* 
a 37,pm=59,99* 


52 (88=72) 
23+m,pm=(40,78)+m* 
2 33,.pm=59,99* 


* The first protected-mode timing is for interrupts to the same vile e level. The second is for 
interrupts to a higher privilege level. Timings for interrupts task gates are not shown. 
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INTO 


Interrupt on Overflow 


JO} DIT | T/S|Z{ Al P| Cc 
Sasa eee 


Generates interrupt 4 if the overflow flag is set. The default DOS 
behavior for interrupt 4 is to return without taking any action. You 
must define an interrupt procedure for interrupt 4 in order for INTO to 
have any effect. 


88/86 53 (88=73),noj=4 
286 24+m.noj=3.pm=(40,78)+m* 
386 =35.noj=3, pm=59,99* 


* The first protected-mode uming is for interrupts to the same privilege level. The second is for 
interrupts to a higher privilege level. Timings for interrupts through task gates are not shown. 


IRET/IRETD 


Interrupt Return 


O| DIT | TISIZ{A PIC 
+ {+]+[+[+f{+]t]4] + 


Returns control from an interrupt procedure to the interrupted code. In 
real mode, the IRET instruction pops IP, CS, and the flags (in that 
order) and resumes execution. See Inte] documentation for details on 
IRET operation in privileged mode. On the 80386, the IRETD 
instruction should be used to pop a 32-bit instruction pointer when 
returning from an interrupt called from a 32-bit segment. 


[toon] 

IRET iret 88/86 32 (88=44) 

IRETD+ 286 = 17+m,pm=(31,55)+m* 
386. 22.pm=38,82* 


* The first protected-mode timing ts for nes to the same privilege level within a task. The 
second is for interrupts to a higher privilege level within a task. Timings for interrupts through task 
gates are not shown. 


+ 80386 only. 
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Jcondition 
Jump Conditionally 


Transfers execution to the specified label if the flags condition is true. 
The condition is tested by checking the flags shown in the table on the 
following page. If the condition is false, then no jump is taken and 
program execution continues at the next instruction. On the 8088- 
80286 processors, the label given as the operand must be short 
(between -128 and 127 bytes from the instruction following the jump). 
On the 80386, the label is near (between -32768 to +32767 bytes) by 
default, but a short jump can be specified with the SHORT operator. 


bigger oe 16,noj=4 
SHORT too_big 7+m,noj=3 
p_even 7+m,no j=3 


disp (2) 


next i 
Jcondition label* ana lesser 
js negative ne J4m noj=3 


* Near labels are only available on the 80386. They are the default. 


CONTINUED... 
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JUMP CONDITIONS 


0 


S 


size 


S 


size 


size 0111 


size 0100 


size 0101 


size 1111 


HUBERBRBHAE 


S 


size | 


size 1001 


size 


size 


size 


size 


size 1010 


size 1011 


SURBE 


Mnemonic 


JB/JNAE 
JAE/JNB 
JBE/JNA 
JA/JNBE 
JE/JZ 
JNE/JNZ 
JL/JNGE 
JGE/JNL 
JLE/JNG 
JG/JNLE 
JS 


JNS 


JNO 
JP/JPE 


JNP/JPO 


Flags Checked Description 


CF=] 


CF=0 


CF=1 or ZF=1 


CF=0 and ZF=0 


ZF=1 


ZF=0 


SF+OF 


SF=OF 


ZF=1 or SF#OF 


ZF=0 or SF=OF 


SF=1 


SF=0 


CF=1 


CF=0 


OF=1 


OF=0 


PF=1 


PF=0 


Jump if below/not above or equal 
(unsigned comparisons) 

Jump if above or equal/not below 
(unsigned comparisons) 

Jump if below or equal/not above 
(unsigned comparisons) 

Jump if above/not below or equal 
(unsigned comparisons) 

Jump if equal (zero) 


Jump if not equal (not zero) 

Jump if less/not greater or equal (signed 
comparisons) 

Jump if greater or equal/not less (signed 
comparisons) 

Jump if less or equal/not greater (signed 
comparisons) 

Jump if greater/not less or equal (signed 
comparisons) 

Jump if sign 

Jump if not sign 

Jump if carry 

Jump if not carry 

Jump if overflow 

Jump if not overflow 


Jump if parity/parity even 


Jump if no parity/parity odd 


Note: The size bits are 0111 for short jumps or 1000 for 80386 near jumps. 
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JCXZ/JECXZ 
Jump if CX is Zero 


O| DIT I TIS{Z/ Al PIC 
ee 


Transfers program execution to the specified label if CX is 0. On the 
80386, JECXZ can be used to jump if ECX is 0. If the count register 
is not O, execution continues at the next instruction. The label given as 
the operand must be short (between -128 and 127 bytes from the 
instruction following the jump). 


18,noj=6 
8+m,noj=4 
9+m,noj=5 


jexz notfound 88/86 
286 
386 


* 80386 only. 


66 PROCESSOR INSTRUCTIONS 


ma mM an 
le i sass 


mT Hm a 


mmmomm Mm 
thd 


mom i 
th) da) id) 


trl 


a a Pe 


O[ DIT T/SIZ/Al PIC 


. 
= 
es 
ote 
oe 

oe 
. 


Jump Unconditionally 


Transfers program execution to the address specified by the destination 
operand. By default, jumps are near (between -32768 and 32767 bytes 
from the instruction following the jump), but you can use an override 
to make them short (between -128 and 127 bytes) or far (in a different 
code segment). With near and short jumps, the operand specifies a new 
IP address. With far jumps, the operand specifies new IP and CS 
addresses. 


SHORT exit oe 
te 
ae 7+m 


Capes 


— close go 
NEAR PTR distant a 
7+m 


SeTeLaL TSOTSI Meee ie eile 


eee 
cere 


CO RA KK NS nA ASI OCR OCR SRO 


disp (4*) 


jmp FAR PTR close shes 
jmp distant Sr ee 
8 12+m,pm=27+mt 


sie 
ae 
ae 7+m 
jmp WORD sateen gis 18+EA 
ae table [di] 11+m 
DWORD [si) 10+m 


mod,\101 rim 


jmp fpointer(si) sls 24+EA 
jmp DWORD PTR [bx] 15+m,pm=26+m 
jmp FWORD PTR [di] ae 12+m,pm=27+m 


* On the 80386, the displacement can be four bytes for near jumps or six bytes for far jumps. 


tTimings for jumps through cal] or task gates are not shown, since they are normally used only in 
operating systems. 


§ 80386 only. You can use DWORD es to specify near register-indirect jumps or FWORD PTR 
to specify far register-indirect jumps 
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LAHF 
Load Flags into AH Register 


Transfers bits 0 to 7 of the flags register to AH. This includes the 
carry, parity, auxiliary carry, zero, and sign flags, but not the trap, 
interrupt, direction, or overflow flags. 


LAR 


Load Access Rights 
80286/386 Protected Only 


Loads the access rights of a selector into a specified register. This 
instruction is only available in privileged mode. The source operand 
must be a register or memory operand containing a selector. The 
destination operand must be a register that will receive the access rights 
if the selector is valid and visible at the current privilege level. The 
zero flag is set if the access rights are transferred, or cleared if they are 
not. See Intel documentation for details on selectors, access rights, and 
other privileged-mode concepts. 


00001111 disp (0, 2, or 4) 


LAR reg/6,reg/6 lar ax,bx 88/86 — 
LAR reg32,reg32* 286 8614 
386 15 
LAR reg!6.mem!16 lar cx,selector 88/86 — 
LAR reg32.mem32* 286 16 
386 16 


* 80386 only. 
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fo[pD]1 [t[s[z[4]P[c] LDS/LES/LFS/LGS/LSS 
Pb et eh fe Load Far Pointer 


Reads and stores the far pointer specified by the source memory 
operand. The pointer's segment value is stored in the segment register 
segment specified by the instruction name. The offset value is stored in 
the register specified by the destination operand. The LDS and LES 
instructions are available on all processors. The LFS, LGS, and LSS 
instructions are available only on the 80386. On the 80386, the size of 
the source and destination operand must match the current segment 
word size. 


ToooToT ai 02) 


lds si,fpointer 88/86 16+EA (88=24+EA) 
LDS reg.mem 286 =7,pm=21 
| aaa ; SASL ‘et 2 Ce 


TOOT 


les di, fpointer 88/86 16+EA (88=24+EA) 
LES reg,mem 286 7,pm=21 
386_ : 7, pm=22 es, 


00001 TTI 10110100 


lfs  edi,fpointer 88/86 — 
LFS reg,mem 286 — 
7,pm=25 


disp (2) 


disp (2 or 4) 


disp (2 or 4) 


lgs bx,fpointer 88/86 — 
LGS reg,mem 286 — 
386 7.pm=25 


00001111 10110010 


lss_ bp, fpointer 88/6 — 
LSS reg,mem 286 — 
386 =. 7, pm=22 


disp (2 or 4) 
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O[DIT {TI S| Zia Pic 


LEA 
Pd 


Load Effective Address 


Calculates the effective address (offset) of the source memory operand 
and stores the result into the destination register. 


10001101 disp (2) 


lea bx,npointer 
LEA reg,mem 


LEAVE 


High Level Procedure Exit 
80186/286/386 Only 


88/86 2+EA 
286 83 
386 2 


Terminates the stack frame of a procedure. LEAVE reverses the action 
of a previous ENTER instruction by restoring SP and BP to the 
values they had before the procedure stack frame was initialized. 


11001001 


LEAVE 


LES/LFS/LGS 


Load Far Pointer to Extra Segment 


See LDS. 
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LGDT/LIDT/LLDT 


Load Descriptor Table 
80286/386 Privileged Only 


Loads a value from an operand into a descriptor table register. LGDT 
loads into the Global Descriptor Table, LIDT into the Interrupt 
Descriptor Table, and LLDT into the Local Descriptor Table. These 
instructions are available only in privileged mode. See Intel 
documentation for details on descriptor tables and other privileged-mode 
concepts. 


00001111 mod, 010,r/m disp (2) 


lgdt descriptor 88/86 — 
LGDT mem64 286 1] 
386 1] 


a (2) 


lidt descriptor 88/86 
LIDT mem64 286 
386 


mod SiOrim] lisp (002 


lidt oe 

LLDT regi6 
ah 
lldt selector 88/86 
LLDT mem!/6 286 
386 
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LMSW 


Load Machine Status Word 
80286/386 Privileged Only 


Loads a value from a memory operand into the Machine Status Word 
(MSW). This instruction is available only in privileged mode. See 
Intel documentation for details on the MSW and other privileged-mode 
concepts. 


dsp O0r2 


lmsw ax 88/86 — 
LMSW reg/6 286 fs 
386 
lmsw machine 88/86 
LMSW mem!/6 286 
386 


LOCK 
Lock the Bus 


O{DIT | T/SI ZAP IC 
Ee ee 


Locks out other processors during execution of the next instruction. 
This instruction is a prefix. It usually precedes an instruction that 
modifies a memory location that another processor might attempt to 
modify at the same time. See Intel documentation for details on 
multiprocessor environments. 


[~ 11110000] 


lock niet ax, sem 88/86 
Lock action instruction 286 
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LODS/LODSB/ 


LODSW/LODSD 
Load Siring Operand 


Loads a string from memory into the accumulator register. The string 
to be loaded is the source and must be pointed to by DS:SI (even if an 
operand is given). For each source element loaded, SI is adjusted 
according to the size of the operands and the status of the direction flag. 
SI is increased if the direction flag has been cleared with CLD or 
decreased if the direction flag has been set with STD. 


If the LODS form of the instruction is used, an operand must be 
provided to indicate the size of the data elements to be processed. A 
segment override can be given. If LODSB (bytes), LODSW (words), 
or LODSD (doublewords on the 80386 only) is used, the instruction 
determines the size of the data elements to be processed and whether the 
element will be loaded to AL, AX, or EAX. Operands are not 
allowed. 


LODS and its variations are not normally used with repeat prefixes, 
since there is no reason to repeatedly load memory values to a register. 


LODS [segreg:]src lods es:source sei “a ee 16) 
LODSB lodsw 
LODSW “a ee : 
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ee eee 


LOOP 
Loop 


Loops repeatedly to a specified label. LOOP decrements CX (without 
changing any flags) and if the result is not 0, transfers execution to the 
address specified by the operand. If CX is 0 after being decremented, 


execution continues at the next instruction. The operand must specify a 
short label (between -128 and 127 bytes from the instruction following 
the LOOP instruction). 


11100010 disp (1) 


loop wend 88/86 17,noj=5 
LOOP label 286 = 8 +m, noj=4 
386 Li+m 


LOOP condition 
Loop If 


O| DIT {T]S|Z{A] PIC 
Ce He ee 


Loops repeatedly to a specified label if condition is met and if CX is 
not 0. The instruction decrements CX (without changing any flags) 
and tests to see if the zero flag was set by a previous instruction (such 
as CMP). With LOOPE and LOOPZ (they are synonyms), 


execution is transferred to the label if the zero flag is set and CX is not 
0. With LOOPNE and LOOPNZ (they are synonyms), execution is 
transferred to the label if the zero flag is cleared and CX is not 0. 
Execution continues at the next instruction if the condition 1s not met. 
Before entering the loop, CX should be set to the maximum number 
of repetitions desired. 


11100001 disp (1) 
LOOPE label loopz again es 18.noj=6 
LOOPZ label 8+m,noj=4 
a 11+m 
|_ 11100000 | disp (1) 


LOOPNE label loopnz for_next 88/86  19,noj=5 
LOOPNZ label 286 = 8, noj=4 
386 = ll+m 
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LSL 


Load Segment Limit 
80286/386 Protected Only 


Loads the segment limit of a selector into a specified register. The 
source operand must be a register or memory operand containing a 
selector. The destination operand must be a register that will receive the 
segment limits if the selector is valid and visible at the current 
privilege level. The zero flag is set if the segment limits are transferred, 
or cleared if they are not. See Intel documentation for details on 
selectors, segment limits, and other privileged-mode concepts. 


disp (0 or 2) 


LSL reg!]6,regl6 ax, Dx ge 
LSL reg32,reg32* 
a4 25t 
LSL reg/6,mem16 cx,seg_lim sis 
LSL reg32,mem32* 
ee ,26t 


* 80386 only. 
+ The first value is for byte granular, the second is for page granular. 


LSS 


Load Far Pointer to Stack Segment 


See LDS. 
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LTR 


Load Task Register 
80286/386 Privileged Only 


Loads a value from the specified operand to the current task register. 
LTR is available only in privileged mode. See Intel documentation for 
details on task registers and other privileged-mode concepts. 


00001111 disp (0 or 2) 


ltr ax 88/86 
em nals em nals 286 
386 


task ae 
LTR mem!/6 
ee 


MOV 


Move Data 


Ol D} 1 | T{S{Z] Al Plc 
Lo Dae Se ee 


Copies the value in the source operand to the destination operand. If the 
destination operand is SS, then interrupts are disabled until the next 
instruction is executed (except on early versions of the 8088 and 8086). 


disp (0 or 2) 
dh, bh get 
MOV reg,reg dx, Cx 2 
bp, sp 
array([di],bx Tae oR (W88=13+EA) 
MOV mem.reg count, Cx 286 
386 
mov bx,pointer 88/86 SER (W88=12+EA) 
MOV reg,mem dx, matrix[bx+di] 286 5 
386 864 


CONTINUED... 
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i= 
a’ 
i 
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101000dw 


MOV mem,immed 


101 lw reg 


mov 
MOV reg,immed 


data (I or 2) 


mov adx,OFFSET string 


disp (0 or 2) 


mov 
MOV mem,accum mov 


disp (0 or 2) 


mov {bx],15 
mov color,? 


cx, 256 


total,ax 
{[di],al 


data (1 or 2) 


88/86 10+EA (W88=14+EA) 


286 3 
cca 


88/86 10 (W88=14) 


286 
386 


HY 


? 
mov al, string(bx] 88/86 10 (W88=14) 

MOV accum,mem MOV ax, fsize 286 865 
a | 386 4 


ds,ax 88/86 2 
MOV segreg,reg/6 286 =. 2,pm=17 
386 =. 2. pm=18 


1000110 disp (0 or 2) 


8+EA (88=12+EA) 
5,pm=19 
.pm=19 


5 

ax,ds 88/86 2 

MOV reg/6,segreg 286 2 
386 = 2 


mov 
mov es,psp 88/86 
MOV segreg,mem!6 286 
386 
mov 

mov stack_save,ss 88/86 9+EA (88=13+EA) 

MOV mem!6,segreg 286 3 

386 2 


: 
: 
9 
| 
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3 
a 
12 
1a 
1s 
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es 
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w 
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MOV 


Move to/from 
Special Registers 
80386 Only 


Stores or loads a value from a special register to or from a 32-bit 
general purpose register. The special registers include the control 
registers CRO, CR2, and CR3; the debug registers DRO, DRI, 
DR2, DR3, DR6, and DR7; and the test registers TR6 and TR7. 
See Intel documentation for details on special registers. 


386 DRO-3= 22,DR6-7=16 


edx,tr6 88/86 
MOV r32.!estreg 


MOV sestreg, r32 


* The reg field contains the register number of the special register (for example, 000 for CRO, 011 for 
DR7, or 111 for TR7). 
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MOVS/MOVSB/ 


MOVSW/MOVSD 
Move String Data 


ODT |T{S|Z{A[ PIC 
pt tt | tt 


Moves a string from one area of memory to another. The source string 
must be pointed to by DS:SI and the destination address must be 
pointed to by ES:DI (even if operands are given). For each element 
moved, DI and SI are adjusted according to the size of the operands and 
the status of the direction flag. They are increased if the direction flag 
has been cleared with CLD, or decreased if the direction flag has been 
set with STD. 


If the MOVS form of the instruction is used, operands must be 
provided to indicate the size of the data elements to be processed. A 
segment override can be given for the source operand (but not for the 
destination). If MOVSB (bytes), MOVSW (words), or MOVSD 
(doublewords on the 80386 only) 1s used, the instruction determines the 
size of the data elements to be processed. Operands are not allowed. 


MOVS and its variations are usually used with the REP prefix. 
Before a move using a repeat prefix, CX should contain the number of 
elements to move. 


1010010w: 


MOVS [ES:]dest,f{segreg:Isrc | rep  movsb 88/86 18(W88=26) 
B 5 


MOVS movs dest,es:source 286 
MOVSW 386 «67 
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MOVSX 


Move with Sign-Extend 
80386 Only 


Copies and sign-extends the value of the source operand to the 
destination register. MOVSX is used to copy a signed 8-bit or 16-bit 
source operand to a larger 16-bit or 32-bit destination register. 


dsp (0,2. or 
movsx eax,bx 
MOVSX reg,reg movsx ecx,bl 
movsx bx,al 
movsx cx,bsign 
MOVSX reg,mem movsx edx,wsign 
movsx eax,bsign 


MOVZX 


Move with Zero-Extend 
80386 Only 


Copies and zero-extends the value of the source operand to the 
destination register. MOVZX is used to copy an unsigned 8-bit or 16- 
bit source operand to a larger 16-bit or 32-bit destination register. 


disp (0,2, 0 4 
MOVZX reg,reg movzx ecx,bl 

movzx bx,al 

movzx cx,bunsign 
MOVZX reg,mem movzx edx,wunsign 

movzx eax, bunsign 
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MUL 
Unsigned Multiply 


Ol D]T I T]s]Z} Alp ic| 
+} TT eee ey) 


Multiplies an implied destination operand by a specified source 
operand. Both operands are treated as unsigned numbers. If a single 16- 
bit operand is given, the implied destination is AX and the product 
goes into the DX:AX register pair. If a single 8-bit operand is given, 
the implied destination is AL and the product goes into AX. On the 
80386, if the operand is EAX, the product goes into the EDX:EAX 
register pair. The carry and overflow flags are set if DX is not 0 for 16- 
bit operands or if AH! is not zero for 8-bit operands. 


disp (0 or 2) 


b=70-77 ,w=118-113 
b=13,w=21 
b=9-14,w=9-22,d=9-38t 
(b=76-83 ,w=124-139H#EA* 
b=16,w=24 
b=1]2-17,w=12-25 d=12-41¢ 


mul 
MUL mem mul 


factor 
WORD PTR [bx] 


* Word memory operands on the 8088 take (128-143)+EA clocks. 


+ The 80386 has an early-out multiplication algorithm. Therefore multiplying an 8-bit or 16-bit value 
in EAX takes the same time as multiplying the value in AL or AX. 


NEG 


Two's Complement Negation 


lO} DIT | TIS|Z{AlP{ Cc 
it] Tt pete tte] +) 


Replaces the operand with its two's complement. NEG does this by 
subtracting the operand from 0. If the operand is 0, the carry flag 1s 
cleared. Otherwise the carry flag is set. If the operand contains the 
maximum possible negative value (-128 fo: 8-bit operands or -32768 
for 16-bit operands), the value does not change, but the overflow and 
carry flags are set. 


Luton} [eed O11 rim) 
88/86 3 

a a 
386 2 

neg balance 88/86 16+EA (W88=24+EA) 

NEG mem 286 7 

386 866 


disp (0 or 2) 
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O[DITIT|SIZ/AI PIC 
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NOP 
No Operation 


Performs no operation. NOP can be used for timing delays or 
alignment. 


* The encoding is the same as for XCHG AX,AX. 


NOT 


One's Complement Negation 


O{ DIT | TI S| Zp aj Pic 
pt tt tt 


Toggles each bit of the operand by clearing set bits and setting cleared 
bits. 


aap (or 2 
ee 3 

a a 
386 2 

masker rae 16+EA (W88=24+EA) 
NOT mem 7 
porn 386 6 
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OR 


Inclusive OR 


Ol DIT TIS{ZlAl Pic 
Ol ft fet+t? t+[o 


Performs a bitwise logical OR on the source and destination operands 
and stores the result to the destination operand. For each bit position in 
the operands, if either or both bits are set, the corresponding bit of the 
result it set. Otherwise, the corresponding bit of the result is cleared. 


disp (0 or 2) 


or ax, ax 88/86 = 3 
OR reg,reg 286 2 
386 2 
or {pp+6],cx 88/86 16+EA (W88=24+EA) 
OR mem,eg or bits, ax 286 7 
386 7 
or bx, masker 88/86 +EA (W88=13+EA) 
OR reg,mem or ax, color[di) 286 
386 
disp (0 or 2) data (I or 2) 
or dx,110110b 88/86 4 
OR reg,immed 286 «3 
386 2 
or flag rec,8 88/86 = (b=17,w=25)+EA 
= 
386 7 


dat or2 


or ax,40h 88/86 4 
OR accum,immed 286 3 
386 2 


9 
7 
6 
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OUT | 
eet Le | 


Output to Port 


Transfers a byte or word (or a doubleword on the 80386) to a port from 
the accumulator register. The port address is specified by the destination 
operand, which can be DX or an 8-bit constant. In privileged mode, a 
general protection fault is generated if OUT is used when the current 
protection level is greater than the value of the IOPL flag. 


out 60h,al 88/86 10 (88=14) 
O 286 «3 
— = : ee _ 386 10,pm=4,24* 


UT immed8,accum 
| AOU 


out dx,ax 88/86 8 (88=12) 
OUT DX,accum out dx,al 286 3 
386 11,pm=5,25* 


* First protected-mode timing: CPL < IOPL. Second timing: CPL > IOPL. 
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OUTS/OUTSB/ 


OUTSW/OUTSD 


Output String to Port 
80186/286/386 Only 


Sends a String to a port. The string is considered the source and must 
be pointed to by DS:SI (even if an operand is given). The output port 
is specified in DX. For each element sent, SI is adjusted according to 
the size of the operand and the status of the direction flag. SI is 
increased if the direction flag has been cleared with CLD or decreased if 
the direction flag has been set with STD. 


If the OUTS form of the instruction is used, an operand must be 
provided to indicate the size of data elements to be sent. A segment 
override can be given. If OUTSB (bytes), OUTSW (words), or 
OUTSD (doublewords on the 80386 only) is used, the instruction 
determines the size of the data elements to be sent. No operand is 
allowed. 


OUTS and its variations are usually used with the REP prefix. Before 
the instruction is executed, CX should contain the number of elements 
to send. In privileged mode, a general protection fault is generated if 
OUTS is used when the current protection level is greater than the 
value of the IOPL flag. 


O1101L lw 


OUTS DX, [segreg:Jsrc | rep outs dx,buffer 88/86 
OUTSB outsb 286 
OUTSW rep outw 386 ia ipm=8,28* 


* First protected-mode timing: CPL < IOPL. Second timing: CPL > IOPL. 
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POP 
Pop 


Ol DIT TI] s|ZlalPic) 
ee 


Pops the top of the stack into the destination operand. This means that 
the value at SS:SP is copied to the destination operand and SP is 
increased by 2. The destination operand can be a memory location, a 
general purpose 16-bit register, or any segment register except CS. 
Use RET to pop CS. On the 80386, 32-bit values can be popped by 
giving a 32-bit operand. ESP is increased by 4 for 32-bit pops. 


01011 reg 


POP regl6 pop cx 88/86 = 8 (88=12) 
POP reg32* 286 «5 
386 4 


1OOO1111 — mod, 000,r/m disp (2) 
POP meml6 pop ae eo ee (88=25+EA) 
POP mem32* 
ais 


soho 8 (88=12) 
pop 5,pm=20 
386 7.pm=21 


00001111 10,sre2,001 


pop ala 
POP segreg* pop 
= 


* 80386 only. 


7 7 pm=21 
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POPA/POPAD 


Pop All 
80186/286/386 Only 


Pops the top 16 bytes on the stack into the eight general-purpose 
registers. The registers are popped in the following order: DI, SI, BP, 
SP, BX, DX, CX, AX. The value for the SP register is actually 
discarded rather than copied to SP. POPA always pops into 16-bit 
registers. On the 80386, use POPAD to pop into 32-bit registers. 


* 80386 only. 


POPF/POPFD 
Pop Flags 


O{DITITIS|Z/AlPIC 


Pops the value on the top of the stack into the flags register. POPF 
always pops into the 16-bit flags register. On the 80386, use POPFD 
to pop into the 32-bit flags register. 


88/86 8 (88=12) 
286 865 
386 = 5 


* 80386 only. 
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PUSH 
Push 


Pushes the source operand onto the stack. This means that SP is 
decreased by 2 and the source value is copied to SS:SP. The operand 
can be a memory location, a general purpose 16-bit register, or a 
segment register. On the 80186-80386 processors, the operand can also 
be a constant. On the 80386, 32-bit values can be pushed by giving a 
32-bit operand. ESP is decreased by 4 for 32-bit pushes. On the 8088 
and 8086, PUSH SP copies the value of SP after the push. On the 
80186-80386 processors, PUSH SP copies the value of SP before 
the push. 


01010 reg 


PUSH reg/6 push dx 88/86 - (88=15) 
PUSH reg32* 286 
386 


disp (2) 


push [di] oe Pid (88=24+EA) 
push fcount 
386 


push es ae on 
push ss 
push cs 


00001111 


PUSH segreg 


01101050 data (I or 2) 


push '‘a' 88/86 — 
PUSH immed push 15000 286 3 
386 2 


* 80386 only. 
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PUSHA/PUSHAD 
Push All 
80186/286/386 Only 


Pushes the general-purpose registers onto the stack. The registers are 
pushed in the following order: AX, CX, DX, BX, SP, BP, SI, DI. 
The value pushed for SP is the value before the instruction. PUSHA 
always pushes 16-bit registers. On the 80386, you can use PUSHAD 
to push 32-bit registers. 


PUSHA | 
PUSHAD* 


* 80386 only. 


PUSHF/PUSHFD 
Push Flags 


Ol DIT ITI S|Z{Al PIC 
ptt tt tt tt 


Pushes the flags register onto the stack. PUSHF always pushes the 
16-bit flags register. On the 80386, use PUSHFD to push the 32-bit 
flags register. 


[10011100 _] 1100 
PUSHF pushf gt . (88=14) 
PUSHFD* 
7 


* 80386 only. 
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RCL/RCR/ROL/ROR 


Rotate 


O|DITITI SIZ} Al PIC) 
Ee satan 


Rotates the bits in the destination operand the number of times 
specified in the source operand. RCL and ROL rotate the bits left; 
RCR and ROR rotate right. 


ROL and ROR rotate the number of bits in the operand. For each 
rotation, the leftmost or rightmost bit is copied to the carry flag as 
well as rotated. RCL and RCR rotate through the carry flag. The carry 
flag becomes an extension of the operand so that a 9-bit rotation is 
done for 8-bit operands, or a 17-bit rotation for 16-bit operands. 


On the 8088 and 8086, the source operand can be either CL or 1. On 
the 80186-80386, the source operand can be CL or an 8-bit constant. 
On the 80186-80386, rotate counts larger than 31 are masked off, but 
on the 8088 and 8086, larger rotate counts are performed despite the 
inefficiency involved. The overflow flag is only modified by single-bit 
variations of the instruction; for multiple-bit variations it is undefined. 


ror ax,l 88/86 2 
rol dl,l 286 2 
386 3 


rcl dx,1 88/86 2 


disp (0 or 2) 


1101000n: 


ROL reg,1 
ROR reg,1 


RCL reg,1 


386 9 


ror bits,l 88/86 15+EA (W88=23+EA) 
rol WORD PTR [bx],1 286 7 

386 7 
rcl WORD PTR [si],1 88/86 15+EA (W88=23+EA) 
rcr WORD PTR m32[0),1 286 7 

386 10 


RCR reg,l rer Diy) 286 2 


ROL mem! 
ROR mem,1 


RCL mem] 
RCR mem, 


ss tad epeenes one of the following bit codes: 000 for ROL, 001 for ROR, 010 for RCL, or O11 
or : 


CONTINUED... 
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TIT*sim\ disp (0 or 2) 


ROL reg,CL 
ROR reg,CL 


RCL reg,CL 
RCR reg,CL 


ROL mem,CL 
ROR mem,CL 


RCL mem,CL 
RCR mem,CL 


ROL reg,immed8 
ROR reg,immed8 


RCL reg,immed8 
RCR reg,immed8 


ror ax,cl 88/86 84+4n 

rol dx,cl 285 5S+n 
. 386 3 

rel dx,cl 88/86 8+4n 

rer bl,cl 286 5+n 
386 9 


ror color,cl 88/86 20+EA+4n (W88=28+EA+4n) 
rol WORD PTR (bpt+6],cl 286 8+n 
386 7 


rcr WORD PTR [bx+di},clj 88/86 20+EA+4n (W88=28+EA+4n) 
rcl masker 286 8+n 
386 10 


rol ax,13 88/86 — 

ror bl,3 286 5+n 
386 3 

rel bx,5 88/86 — 

rer si,9 286 5+n 

386 9 


ROL mem,immed8 rol BYTE PTR [bx},10 88/86 — 
ROR mem,immea8& ror bits,6 286 8+n 
386 7 


RCL mem,immed8 
RCR mem,inuned8 


rcl WORD PTR [bp+8),5 | 88/86 — 
rer masker,3 286 8+n 
386 10 


” pa repreeor one of the following bit codes: 000 for ROL, 001 for ROR, 010 for RCL, or O11 


for 
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REP 
Repeat String 


JO] DIT ITI S|Z{ Al Pic) 
FES OF WS 


Repeats the string instruction the number of times indicated by CX. 
For each string element, the string instruction is performed and CX is 
decremented. When CX reaches 0, execution continues with the next 
instruction. REP is normally used with MOVS and STOS. (REP 
LODS is legal, but has the same effect as LODS.) REP is 
additionally used with INS and OUTS on the 80186-80386 
processors. On all processors except the 80386, combining a repeat 
prefix with a segment override may cause errors if an interrupt occurs 
during a string operation. 


1010010w 


REP MOVS dest,src rep movs source,destin | 88/86 94+17n (W88=9+25n) 
REP MOVSB rep movsw 
LLANE) 5h: a (ee ae ee 7 awa 


REP STOS desz rep stosb 88/86 9+10n (W88=9+14n) 
REP STOSB rep  stos destin 286 44+3n 
REP STOSW a 386 5+5n ; 


rep insb 88/86 — 
rep ins destin,dx 286 5+4n 
_ : | 386 __13+6n,pm=(7,27)+6n* 


REP OUTS DX,src rep outs dx,source 
REP OUTSB rep  outsw 
REP OUTSW 


* First protected-mode timing: CPL $s IOPL. Second timing: CPL > IOPL. 
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REP condition 
Repeat String Conditionally 


[PIC 
oe i 


OP ITSTZ 
ia a Dd ES 


Repeats a string instruction as long as condition is true and the 
maximum count has not been reached. REPE and REPZ (the names 
are synonyms) repeat while the zero flag is set. REPNE and REPNZ 
(the names are synonyms) repeat while the zero flag is cleared. The 
conditional repeat prefixes should only be used with SCAS and 
CMPS, since these are the only string instructions that modify the 
zero flag. Before executing the instruction, CX should be set to the 
maximum allowable number of repetitions. For each string element, 
the string instruction is performed, CX is decremented, and the zero 
flag is tested. On all processors except the 80386, combining a repeat 
prefix with a segment override may cause errors if an interrupt occurs 
during a string operation. 


REPE CMPS dest,src repz cmpsb 88/86 9+22n (W88=9+30n) 
REPE CMPSB repe cmps destin,src 286 5+9n 
REPE CMPSW _ 386 5+9n 


REPE SCAS dest repe scas destin 88/86 9+15n (W88=9+19n) 
REPE SCASB repz scasw 286 = 5+8n 
REPE SCASW 386 5+8n 


repne cmpsw 88/86 9+22n ere 
repnz cmps destin,src 286 5+9n 

_386_ 5+9n 
repne scas destin gs 9+15n (W88=9+19n) 
repnz scasb 5+8n 

ee 5+8n 


REPNE CMPS dest,src 
REPNE CMPSB 
REPNE CMPSW 


REPNE SCAS dest 
REPNE SCASB 
REPNE SCASW 
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RET/RETN/RETF 


Return from Procedure 


O{DIT{TIS{Z[AlPI Cc 
Ee GE a 


Returns from a procedure by transferring control to an address popped 
from the top of the stack. A constant operand can be given indicating 
the number of additional bytes to release. The constant is normally 
used to adjust the stack for arguments pushed before the procedure was 
called. Under MASM, the size of a return (near or far) is the size of 
the procedure in which the RET is defined with the PROC directive. 
Starting with Version 5.0, RETN can be used to specify a near return; 


RETF can specify a far return. A near return works by popping a word 
into IP. A far return works by popping a word into IP and then 
popping a word into CS. After the return, the number of bytes given 
in the operand (if any) is added to SP. 


sah 16 (88=20) 
RETN fie 11+m 
a 10+m 


88/86 20(88=24) 
RETIN immed8s retn 8 286 114m 
386 10+m 


ee 26 (88=34) 
RETF 15+m,pm=25+m,55* 
ae 18+m,pm=32+m,62* 


data (2) 


11001010 


RET inuned16 ret cee 
RETF invned/6 retf : 2 
i 


* The first protected mode timing is for a return to the same privilege level; the second is for a retum 
to a lesser privilege level. 


25 (88=33) 
15+m,pm=25+m,55* 
18+m,pm=32+m,68* 
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DU 


ROL/ROR 


Rotate 


See RCL/RCR 


SAHF 
Store AH into Flags 


Ol DIT {TI S{Z{Al PIC: 
ES ESE 


Transfers AH into bits 0 to 7 of the flags register. This includes the 
Carry, parity, auxiliary carry, zero, and sign flags, but not the trap, 
interrupt, direction, or overflow flags. 
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SAL/SAR/SHL/SHR 
Shift 


Oj DIT | TI] s{Z} al Plc 
Ee EE ESE 


Shifts the bits in the destination operand the number of times specified 
by the source operand. SAL and SHL shift the bits left; SAR and 
SHR shift right. 


With SHL, SAL, and SHR, the bit shifted off the end of the operand 
is copied into the carry flag and the leftmost or rightmost bit opened by 
the shift is set to 0. With SAR, the bit shifted off the end of the 
operand is copied into the carry flag and the leftmost bit opened by the 
shift retains its previous value (thus preserving the sign of the 
operand). SAL and SHL are synonyms; they have the same effect. 


On the 8088 and 8086, the source operand can be either CL or 1. On 
the 80186-80386 processors, the source operand can be CL or an 8-bit 
constant. On the 80186-80386 processors, shift counts larger than 31 
are masked off, but on the 8088 and 8086, larger shift counts are 
performed despite the inefficiency involved. The overflow flag is only 
modified by single-bit variations of the instruction; for multiple-bit 
variations it is undefined. 


mod, TTT*,rim disp (0 or 2) 


sar di,l 88/86 2 
386 «63 
2 


shr  dh,l 88/86 
shl si,l 286 2 
sal bx,1 386 3 
sar count, 1 88/86 1S+EA (W88=23+EA) 
SAR mem.1 286 #837 
386 «7 


SAL mem,1 sal WORD PTR m32[0],1] 80/86 5+EA (W88=23+EA) 
SHL mem shl  index,1 
SHR mem,1 shr unsign[di],1 


* TTT represents one of the following bit codes: 100 for SHL or SAL, 101 for SHR, or 111 for SAR. 


CONTINUED... 
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dd 
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disp (0 or 2) 


sar bx,cl 88/86 
sar dx,cl 286 
386 

SAL reg,CL shr dx,cl 88/86 
shl di,cl 286 


SHL reg,CL 
SHR ree,CL sal _ah,cl 386 


Sar sign,cl 88/86 
SAR mem,CL sar WORD PTR [bp+8],cl] 286 
386 


SAL mem,CL shr WORD PTR m32(2],c1 | 88/86 
SHL mem,CL sal BYTE PTR [(diJ,cl 
SHR mem, CL shl_index,cl Be a 


1d = ee) - 


SAR reg,CL 


disp (0 or 2) 


sar bx,5 88/86 
sar ‘cl;5 286 

386 
sal cx,6 88/86 
SHL reg,immed8& shl di,2 286 
SHR reg,immed8 shr bx,8 386 


sar sign_count, 3 88/86 
SAR mem,immed8 sar WORD PTR {bx),5 286 
386 


SAL mem,immed8 shr meml16,11 | 88/86 
SHL mem,immed8 shl unsign, 4 286 
SHR mem,immed8 sal array(bx+di),14 386 


SAR reg,immed8& 


SAL reg,immed8& 


8+4n 

S+n 

3 

8+4n 

S§+n 

3 

204+EA+4n (W88=28+EA+in) 
8+n 

7 . 
20+EA+4n (W88=28+EA+4n) 


S+n 
3 
5+n 
3 


8+n 
7 
8+n 
7 


* TTT represents one of the following bit codes: 100 for SHL or SAL, 101 for SHR, or 111 for SAR. 
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SBB 


Subtract with Borrow 


O|D]T | TIS{Z{Al Pic 
Fa ES ES ES ESE 


Subtracts the source from the destination, then subtracts the the value 
of the carry flag from the result. This result is assigned to the 
destination. SBB is used to subtract the least significant portions of 
numbers that must be processed in multiple registers. 


disp (0 or 2) 


sbb dx,cx 88/86 3 
286 2 
386 =2 

sbb WORD PTR m32[(2),dx 88/86 16+EA (W88=24+EA) 
2860=— 7 
386 «66 

sbb dx,WORD PTR m32[2} 88/86 9+EA (W88=13+EA) 
286 7 
386 7 


mod,O\L, r/m 


sbb dx, 45 88/86 4 
286 «3 
386 2 
sbb WORD PTR m32[2],40] 88/86 17+EA (W88=25+EA) 
286 =7 
386 67 


disp (0 or 2) data (1 or 2) 


data (I or 2) 
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SCAS/SCASB/ 


SCASW/SCASD 
Scan String Flags 


O[DITITISIZjAlPic 
Fl ES ES FS ESE 


Scans a string to find a value specified in the accumulator register. The 
string to be scanned is considered the destination and must be pointed 
to by ES:DI (even if an operand is specified). For each element, the 
destination element is subtracted from the accumulator value and the 
flags are updated to reflect the result (although the result is not stored). 
DI is adjusted according to the size of the operands and the status of the 
direction flag. DI is increased if the direction flag has been cleared with 
CLD or decreased if the direction flag has been set with STD. 


If the SCAS form of the instruction is used, an operand must be 
provided to indicate the size of the data elements to be processed. No 
segment override is allowed. If SCASB (bytes), SCASW (words), or 
SCASD (doublewords on the 80386 only) is used, the instruction 
determines the size of the data elements to be processed and whether the 
element scanned for is in AL, AX, or EAX. No operand is allowed. 


SCAS and its variations are usually used with repeat prefixes. 
REPNE (or REPNZ) is used to find the first match of the 
accumulator value. REPE (or REPZ) is used to find the first 
nonmatch. Before the comparison, CX should contain the maximum 
number of elements to compare. After the comparison, CX will be 0 if 
no match or nonmatch was found. Otherwise SI and DI will point to 
the element after the first match or nonmatch. 


SCAS [ES:]dest repne  scasw i 7 (W88=19) 
SCASB repe scasb 
SCASW scas es:destin ae 
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SETcondition 


Set Conditionally 
80386 Only 


Sets the byte specified in the operand to 1 if condition is true or to 0 if 
condition is false. The condition 1s tested by checking the flags shown 
in the table on the following page. The instruction is used to 
conditionally set Boolean flags. 


setc dh 
SETcondition reg8 setz al 
setae bl 
seto BTYE PTR [bx] 
SET condition mem8 setle flag 286 
sete Booleans [di] 386 


CONTINUED... 
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Mnemonic 


SETB/SETNAE 


SETAE/SETNB 


SETBE/SETNA 


SETA/SETNBE 


SETE/SETZ 
SETNE/SETNZ 


SETL/SETNGE 


SETGE/SETNL 


SETLE/SETNG 


SETG/SETNLE 


SETS 
SETNS 
SETC 
SETNC 
SETO 
SETNO 
SETP/SETPE 


SETNP/SETPO 


SET CONDITIONS 


Flags Checked 


CF=1 
CF=0 
CF=1 or ZF=! 


CF=0 and ZF=0 


SF+OF 
SF=OF 
ZF=1 or SF#OF 
ZF=0 or SF=OF 


SF=1 

SF=0 
CF=1 
CF=0 
OF=1 
OF=0 
PF=1 


PF=0 
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Description 


Set if below/not above or equal 
(unsigned comparisons) 


Set if above or equal/not below 
(unsigned comparisons) 


Set if below or equal/not above 
(unsigned comparisons) 


Set if above/not below or equal 
(unsigned comparisons) 


Set if equal/zero 
Set if not equal/not zero 


Set if less/not greater or equal 
(signed comparisons) 


Set if greater or equal/not less 
(signed comparisons) 


Set if less or equal/not greater or 
equal (signed comparisons) 


Set if greater/not less or equal 
(signed comparisons) 


Set if sign 

Set if not sign 

Set if carry 

Set if not carry 

Set if overflow 

Set if not overflow 

Set if parity/parity even 


Set if no parity/parity odd 


SGDT/SIDT/SLDT 


Store Descriptor Table 
80286/386 Privileged Only 


Stores a Descriptor Table register into a specified operand. SGDT 
stores the Global Descriptor Table; SIDT, the Interrupt Descriptor 
Table; and SLDT, the Local Descriptor Table. These instructions are 
available only in privileged mode. See Intel documentation for details 
on descriptor tables and other privileged-mode concepts. 


mod, 000,r/m 


slidt ax 
SLDT reg/6 

sldt selector 
SLDT mem16 


disp (0 or 2) 


2 
2 
3 
2 


SHL/SHR 
Shift 


See SAL/SAR 
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SHLD/SHRD 


Double Precision Shift 
80386 Only 


Shifts the bits of the second operand into the first operand. The number 
of bits shifted is specified by the third operand. SHLD shifts the first 
operand to the left by the number of positions specified in the count. 
The positions opened by the shift are filled by the most significant bits 
of the second operand. SHRD shifts the first operand to the right by 
the number of positions specified in the count. The positions opened 
by the shift are filled by the least significant bits of the second operand. 
The count operand can be either CL or an 8-bit constant. If a shift 
count larger than 31 is given, it will be adjusted by using the remainder 
(modulus) of a division by 32. 


00001111 10100100 disp (0 or 2) 
SHLD reg/6,reg/6,immed8 | shld ax,dx,1i0 88/86 
SHLD reg32,reg32,immed 8 286 — 

386 = 3 
SHLD mem!]6,reg]6,immed8| shid bits,cx,5 — 
SHLD mem32,reg32,immed8 — 
j 

00001111 10101100 disp (0 or 2) 
SHRD reg/6,regl6,immed8 } shrd cx,si,3 88/86 — 
SHRD reg32,reg32,immed 8 286 — 

386 «3 
SHRD mem!6,reg]6,immed8| shrd {[di],dx,13 88/86 — 
SHRD mem32,re232,immed8 286 — 
7 


00001111 10100101 disp (0 or 2) 


SHLD reg/6,regi6,CL shld ax,dx,cl 88/86 3 — 
SHLD reg32,reg32,CL 28 
SHLD mem!6.reg]16,CL shld masker,ax,cl 
SHLD mem32,reg32,CL 
00001111 disp (0 or 2) 


SHRD reg/6,reg/6,CL shrd bx,dx,cl 
SHRD reg32,reg32,CL 


SHRD mem/6,reg16,CL shrd_ [bx],dx,cl 
SHRD mem32,reg32,CL 
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SMSW 


Store Machine Status Word 
80286/386 Privileged Only 


Stores the Machine Status Word (MSW) into a specified memory 
operand. SMSW is available only in privileged mode. See Intel 
documentation for details on the MSW and other privileged-mode 
concepts. 


disp (0 or?) 
88/86 — 
386 ~=6.:110 
smsw machine 88/86 ~ 


STC 
Set Carry Flag 


Sets the carry flag. 
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STD 


Sei Direction Flag 


Sets the direction flag. All subsequent string instructions will process 
down (from high addresses to low addresses). 


STI 
Set Interrupt Flag 


Ol D]1 [TI si Za] Ptc) 
ae Wa te Na 


Sets the interrupt flag. When the interrupt flag is set, maskable 
interrupts are recognizcd. If interrupts were disabled by a previous CLI 
instruction, pending interrupts will not be executed immediately; they 
will be executed after the instruction following STI. 
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STOS/STOSB/ 


STOSW/STOSD 
Store String Data 


Stores the value in the accumulator to a string. The string to be filled 
is the destination and must be pointed to by ES:DI (even if an operand 
is given). For each source element loaded, DI is adjusted according to 
the size of the operands and the status of the direction flag. DI is 
increased if the direction flag has been cleared with CLD or decreased if 
the direction flag has been set with STD. 


If the STOS form of the instruction is used, an operand must be 
provided to indicate the size of the data elements to be processed. No 
segment override is allowed. If STOSB (bytes), STOSW (words), or 
STOSD (doublewords on the 80386 only) is used, the instruction 
determines the size of the data elements to be processed and whether the 
element will be from AL, AX, or EAX. No operand is allowed. 


STOS and its variations are often used with the REP prefix. Before 
the repeated instruction is executed, CX should contain the number of 
elements to store. 


STOS [ES:]des: Stos es:dstring 88/86 11 (W88=15) 
STOSB rep stosw 286 863 
STOSW rep stosb 386 64 


106 PROCESSOR INSTRUCTIONS 


mM OK 


Sr nw rn ee ee ee ee es 2 ees 2 ee A ee es 9s 


LY 
ob ha aaa daa 


vw 


mm OM 


mmm mH mM mM 


mmommnmm@mmmmm 
Tata 


1) ub) 


iT 


STR 


Store Task Register 
80286/386 Privileged Only 


Stores the current task register to the specified operand. This 
instruction is only available in privileged mode. See Intel 
documentation for details on task registers and other privileged-mode 
concepts. 


disp (0 or 2) 


str cx 88/86 
STR regl6 286 
386 
str taskreg 88/86 
STR meml6 286 
386 


de 
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PROCESSOR INSTRUCTIONS _107 


oe 


a A ne te 


SN Ss BS SINS OAS SSN SS 


SRR IOR NSN CRN HSS ae NR KS 


6) wee 


<-v 


2. 


____10SS390100 


SUB 
Subtract 


O[ DIT | T{s{Z/ Al Pic) 
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Subtracts the source operand from the destination operand and stores the 
result in the destination operand. 


001010dw disp (0 or 2) 

sub ax,bx 3 
SUB reg,reg sub bh,dh 2 
2 

sub tally,bx he 16+EA (W88=24+EA) 
SUB mem,reg sub array(diJ,bl 7 
a 6 

sub cx,discard 88/86 9+EA (W88=13+EA) 
SUB reg,mem sub al, (bx) 286 7 
386 7 


dsp(00r2) dat or2) 


sub dx, 45 88/86 4 
386 2 
sub total, 4000 88/86 17+EA (W88=25+EA) 
SUB mem,immed sub BYTE PTR [bxtdi],2 286 : 
386 


00101 10w data (1 or 2) 


sub ax, 32000 88/86 4 
SUB accum,immed 286 3 
386 2 


108 PROCESSOR INSTRUCTIONS 


c 


maa | A AT |! | | Mom om 


Oy. ey er ee OP: el 


™" Mm MH 


a ie a ee 
ar imei 


Ww UU Ww ow UU UD 


i en er 


ou Ww Ww ou Ww Ww 


ti ie ae 


Ls 
Ul) 


‘TEST 


Logical Compare 


ofo]r | tis [Zz alpic| 
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Tests specified bits of an operand and sets the flags for a subsequent 
conditional jump or set instruction. One of the operands contains the 
value to be tested. The other contains a bit mask indicating the bits to 
be tested. TEST works by doing a logical bitwise AND on the source 
and destination operands. The flags are modified according to the result, 
but the destination operand is not changed. This instruction is the same 
as the AND instruction, except that the result is not stored. 


test dx,bx a 
TEST reg,reg test bl,ch 
a 


TEST mem,reg* test dx,flags 88/86 +EA (W88=13+EA) 
TEST reg,mem test bl,bitarray(bx] 286 
386 


disp (0 or 2) 


disp (0 or 2) data (I or 2) 


test cx,30h eee 5 
TEST reg,immed test cl,1011b 3 
oe 2 
test masker,1 88/86 L1+EA 
386 


[1010100w | 


test ax,90h 88/86 4 
TEST accum,immed 286 3 
386 2 


* MASM transposes TEST mem,reg so that it is encoded as TEST reg,mem. 


data (1 or 2) 
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VERR/VERW 


Verify Read or Write 
80286/386 Protected Only 


Verifies that a specified segment selector is valid and can be read or 
written to at the current privilege level. VERR verifies that the 
selector is readable. VER W verifies that the selector can be written to. 
If the segment is verified, the zero flag is set. Otherwise the zero flag is 
cleared. These instructions are available only in privileged mode. See 
Intel documentation for details on segment selectors and other 
privileged-mode concepts. 


disp (0 or 2) 


88/86 3 — 
286 814 
386 ~=—:10 

88/86 — 
286 =: 16 
38611 


disp (0 or 2) 


88/86 =— 
286 «= 14 
386 = 15 


verw selector 88/86 — 
VERW mem!6 286 16 
386 16 
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WAIT 
Wait 


lO[ DIT ITI S| Z{Al Pic 
Bae 


Suspends CPU execution until a signal is received that a coprocessor 
has finished a simultaneous operation. It should be used to prevent a 
coprocessor instruction from modifying a memory location that is 
being modified at the same time by a processor instruction. WAIT is 
the same as the coprocessor FWAIT instruction. 


XCHG 


Exchange 


O[ DIT | TIS|Z{A| PIC 
pt te et tt 


Exchanges the values of the source and destination operands. 


100001Iw) [“modregrim ] — disp(0or2) 


xchg cx,dx 88/86 4 
XCHG reg,reg xchg 1,dh 286 
xchg al,ah 386 


3 
3 
XCHG regynem xchg [bx],ax ss fe 17+EA (W88=25+EA) 
XCHG mem,reg xchg bx,pointer 5 

aes 5 


10010 reg 


XCHG accum,reg]6* xchg ax,cx 
XCHG reg!l6,accum* xchg cx,ax 


* On the 80386, the accumulator may also be exchanged with a 32-bit register. 
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XLAT/XLATB 


Translate 


O[D]T | T}s{Z/alPIc| 
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Translates a value from one coding system to another by looking up 
the value to be translated in a table stored in memory. Before the 
instruction is executed, BX should point to a table in memory and AJ, 
should contain the unsigned position of the value to be translated fron: 
the table. After the instruction, AL will contain the table value with 
the specified position. No operand is required, but one can be given in 
order to specify a segment override. DS is assumed unless a segment 
override is given. Starting with version 5.0, XLATB is recognized as 
a synonym for XLAT. Either version allows an operand, but neither 
requires one. 


NT 
XLAT [[segreg}:mem] xlat Tm 
XLATB [fsegreg]:mem] | xlatb es:table 286 
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Exclusive OR 


Performs a bitwise exclusive OR on the source and destination 
operands, and stores the result to the destination. For each bit position 
in the operands, if both bits are set or if both bits are cleared, the 
corresponding bit of the result is cleared. Otherwise, the corresponding 
bit of the result is set. 


disp (0 or 2) 


xor cx,bx 88/86 = 3 
XOR reg,reg xor  ah,al 286 «62 
386 2 


OR memeee xOr {bp+10), cx 88/86 16+EA (W88=24+EA) 
XOR mem,reg xor masked, bx 286 #867 

386 36-6 | 
XOr cx, flags 88/86 9+EA (W88=13+EA) 
386 7 


ei vos PaPUR Ee < t “ 


disp (0 or 2) data (1 or 2) 


88/86 4 
286 «63 
386 «2 
xOr Boolean, 1 88/86 7+EA (W88=25+EA) 
XOR mem,immed xor switches(bx],101b 86 


xor bx, 10h 
XOX bl,1l 


XOR reg,immed 


data (1 or 2) 


xor ax,01010101b 
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Interpreting Coprocessor Instructions 
Syntax 
Examples 
Clock Speeds 
Instruction Size 


Architecture 
Instructions 
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Topical Cross-Reference 


Load 


FLD/FILD/FBLD 
FXCH 

FLDCW 

FLDENV 
FSTENV/FNSTENV 


Store Data 


FST/FIST 
FSTP/FISTP/FBSTP 
FSTCW/FNSTCW 
FSTSW/FNSTSW 
FSAVE/FNSAVE 
FRSTOR 


Load Constant 


FLDI 
FLDL2E 
FLDL2T 
FLDLG2 
FLDLN2 
FLDPI 
FLDZ 


* 80287 only. 


Arithmetic 
FADD/FIADD 
FADDP 
FSUB/FISUB 
FSUBP 
FSUBR/FISUBR 
FSUBRP 
FMUL/FIMUL 
FMULP 
FSCALE 
FDIV/FIDIV 
FDIVP 
FDIVR/FIDIVR 
FDIVRP 
FABS 

FCHS 
FRNDINT 
FSQRT 
FPREM 
FPREMI f 
FXTRACT 


+ 80387 only. 


Transcendental 


FPTAN 
FPATAN 
FSIN t 
FCOS t 
FSINCOS t 
F2XM 
FYL2X 
FYL2PI 
FPREEM 
FPREMI t 


Compare 


FCOM/FICOM 
FCOMP/FICOMP 
FCOMPP 
FUCOM t 
FUCOMP ft 
FUCOMPP t 
FTST 

FXAM 
FSTSW/FNSTSW 


§ 8087 only. 


Processor 


Control 


FINIT/FNINIT 
FFREE 

FNOP 

FWAIT 
FDECSTP 
FINCSTP 
FCLEX/FNCLEX 
FSETPM * 
FDISU/FNDISI § 
FENY/FNENI § 
FSAVE/FNSAVE 
FLDCW 
FRSTOR 
FSTCW/FNSTCW 
FSTSW/FNSTSW 
FSTENV/FNSTENV 
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COPROCESSOR 


Interpreting Coprocessor Instructions 


This section provides an alphabetical reference to instructions of the 
8087, 80287, and 80387 coprocessors. The format is the same as for 
the processor instructions except that encodings are not provided. 
Differences are noted below. 


Syntax 


Syntaxes in Column | use the following abbreviations for operand 
types: 


reg A coprocessor stack register 

memreal A direct or indirect memory operand where a real number ts 
stored 

memint A direct or indirect memory operand where a binary integer 
is stored 

membcd A direct or indirect memory operand where a BCD number is 
stored 

Examples 


The examples in Column 2 are randomly chosen, and no significance 
should be attached to their order or placement. They are valid examples 
of the associated syntax, but there 1s no attempt to illustrate all 
possible operand combinations or to show context. Their position is 
not related to the clock speeds in Column 3. 


Clock Speeds 


Column 3 shows the clock speeds for each processor. Sometimes an 
instruction may have more than one possible clock speed. The 
following abbreviations are used to specify variations: 


EA Effective address. This applies only to the 8087. See the 
Processor Section, “Timings on the 8080 and 8086 
Processors," for an explanation of effective address timings. 


s,],t Short real, long real, and 10-byte temporary real. 
w,d,q Word, doubleword, and quadword binary integer. 
tf To or from stack top. On the 80387, the t clocks represent 


timings when ST is the destination. The f clocks represent 
timings when ST is the source. 
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instruction Size 


The instruction size is always two bytes for instructions that do not 
access memory. For instructions that do access memory, the size is 
four bytes on the 8087 and 80287. On the 80387, the size for 
instructions that access memory is four bytes in 16-bit mode or six 
bytes in 32-bit mode. 


On the 8087, each instruction must be preceded by the WAIT (also 
called FWAIT) instruction, thereby increasing the instruction's size by 
one byte. MASM inserts WAIT automatically by default, or with 
the .8087 directive. 


Architecture 


The 8087, 80287, and 80387 coprocessors have several elements of 
architecture in common. All have a register stack made up of eight 80- 
bit data registers. These can contain floating-point numbers in the 
temporary real format. The coprocessors also have 14 bytes of control 
registers. The format of registers is shown in Figure 2. 


Data Register Stack 


Mantissa 


Control word 
Status word 
Tag word 


Instruction pointer 


Operand pointer 


Figure 2 Coprocessor Registers 
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The most important control registers are the control word and the status 
word. The format of these registers is shown in Figure 3. 


Control Word 


15 7 0 
TS I  _<ea nS” Le LD aS i AL Ln” TO, 
fx x x fie] ac | ro [ie] [rmfumjom[zm[oulm 

Status Word 

15 


7 0 
TS a LEE ATE TEED EEE LD A LL SE EI SO” 
fofeal sr foafer[cofes]or fre [oefoe[efoef el 


Abbreviations for Fields in Control Word and Status Word 


: ity Contro I ask 
0 = Projective (default on 8087 and 80287) PM/PE - Precision 
1 = Affine UM/UE - Underflow 
*8087 and 80287 only; 80387 OM/OE - Overflow 
uses affine regardless of setting ZM/ZE - Zero Divide 
DM/DE - Denormalized Operand 
RC - Rounding Control IM/IE - Invalid Operation 
00 = Round to nearest or even (default) For masks, 
01 = Round down toward -infinity 1 = masked; 0 = unmasked 
10 = Round up toward +infinity For exceptions, 
11 = Chop by truncating toward 0 ] = exception; 0 = no exception 
PC - Precision Control B - Busy 
00 = 24-bit mantissa (1 = exception control unit active) 
10 = 53-bit mantissa 
11 = 64-bit mantissa (default) C3 
C2 | Condition Codes 
- Int t Ena Cl 
* 8087 only; undefined on 80287 CO 
and 80387 
ST - Stack Top Pointer 
SF - Stack Flag (points to current top of stack) | 
* 80387 only: undefined on 8087 i 
and 80287 ES - Error Summary (80287-387) 
* IR - Interrupt Request on 8087 | 
Figure 3 Control Word and Status Word | 
{ 
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F2XM1 
2QX.4 


Calculates Y = 2% - 1. X is taken from ST. The result, Y, is returned 
in ST. X must be in the range 0 < X < 0.5 on the 8087 and 80287, or 
in the range -1.0 < X < +1.0 on the 80387. 


£2xml 87 310-630 
F2XM1 287 310-630 
387 =—21 1-476 


FABS 


Absolute Value 


Converts the element in ST to its absolute value. 


fabs 87 =10-17 
FABS 287 =: 10-17 
387 22 
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FADD/FADDP/FIADD 
_ Add 


Adds the source to the destination and returns the sum in the 
destination. If two register operands are specified, one must be ST. If a 
memory operand ts specified, the sum replaces the value in ST. 
Memory operands can be 32- or 64-bit real numbers or 16- or 32-bit 
integers. If no operand is specified, ST is added to ST(1) and the stack 
is popped, returning the sum in ST. For FADDP, the source must be 
ST; the sum is returned in the destination and ST is popped. 


fadd st,st(2) 87 

FADD [reg,reg] fadd st(5),st 287 70-100 
| fadd 387 = t=23-31,f=26-34 
appr est faddp st(6),st 87 75-105 
FADDP reg,ST 287 ~=75-105 
387 =. 23-31 

fadd QWORD PTR [bx] (s=90-120,s=95 125+EA 
FADD memreal fadd  shortreal s=90-120,I=95-125 
fiadd intl6 
FIADD memint fiadd warray([di} 
fiadd double 


70-100 


s=24-32,l=29-37 
87 = (w=102-137,d=108-143)+EA 

287 3 =w=102-137,d=108-143 

387 = w=71-85,d=57-72 


FBLD 
Load BCD 


See FLD. 


FBSTP 
Store BCD and Pop 


See FST. 
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FCHS 
Change Sign 


Reverses the sign of the value in ST. 


fchs a 87 10-17 
FCHS 287 10-17 
| 387 24-25 


FCLEX/FNCLEX 


Clear Exceptions 


Clears all exception flags, the busy flag and bit 7 in the status word. 
Bit 7 is the interrupt request flag on the 8087 and the error status flag 
on the 80287 and 80387. The instruction has wait and no-wait 
versions. 


FCLEX fclex 87 2-8 
FNCLEX 287 2-8 
387 «11 
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FCOM/FCOMP/FCOMPP/ 
FICOM/FICOMP 


Compare 


Compares the specified source to ST and sets the condition codes of 
the status word according to the result. The instruction works by 
subtracting the source operand from ST without changing either 
operand. Memory operands can be 32- or 64-bit real numbers or 16- or 
32-bit integers. If no operand 1s specified or if two pops are specified, 
ST is compared to ST(1) and the stack is popped. If one pop is 
specified with an operand, the operand is compared to ST. If one of the 
operands is a NAN, an invalid-operation exception is generated (see 
FUCOM for an alternative method of comparing on the 80387). 


fcom st (2) 87 40-50 

FCOM [reg] fcom 287 40-50 
387 624 

fcomp = st (7) 87 42-52 

FCOMP freg] fcomp 287 42-52 
387 26 

fcompp 87 45-55 

FCOMPP 287 45-55 
387 26 


fcom shortreals(di}] (s=60-70,1=65-75)+EA 
FCOM memreal fcom longreal s=60-70,1=65-75 
s=26.)=31 
fcomp longreal (s=63-73,1=67-77)+EA 
FCOMP memreal fcomp shorts[di] s=63-73,1=67-77 
s=26,/=31 
double (W=72-86,d=78-91)+EA 


w=72-86,d=78-9 1 
w=71-75,d=56-63 
(w=74-88.d=80-93)+EA 
w=74-88 d=80-93 
w=71-75,d=56-63 


warray(di} 


ficom 
FICOM > memint ficom 

ficomp WORD PTR [bp+6] 
FICOMP memint ficomp darray([di} 


Condition Codes for FCOM 


C3 C2 C} C0 Meaning 

0 0 ? 0 ST > source 

0 0 2 | ST < source 

1 0 ? 0 ST = source 

I ] ? ] ST is not comparable to source 
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FCOS 


Cosine 
80387 Only 


Replaces a value in radians in ST with its cosine. If ST is in the range 
IST! < 293, the C2 bit of the status word is cleared and the cosine is 
calculated. Otherwise, C2 is set and no calculation is done. ST can be 
reduced to the required range with FPREM or FPREM1. 


fcos 87 — 
FCOS 237 — 
387 123-772* 


* For operands with an absolute value greater than 1/4, up to 76 additional clocks may be required. 


FDECSTP 


Decrement Stack Pointer 


Decrements the stack top pointer in the status word. No tags or 
registers are changed and no data are transferred. If the stack pointer is 
0, FDECSTP changes it to 7. 


fdecstp 87 6-12 
FDECSTP 287 =6-12 
387 =—.22 


FDISI/FNDISI 


Disable Interrupts 
8087 Only 


Disables interrupts by setting the interrupt enable mask in the control 
word. This instruction has wait and no-wait versions. Since the 80287 
and 80387 do not have an interrupt enable mask, the instruction is 
recognized but ignored on these coprocessors. 


fdisi 87 =—2-8 
287 2 
387 2 
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FDIV/FDIVP/FIDIV 
Divide 


Divides the destination by the source, and returns the quotient in the 
destination. If two register operands are specified, one must be ST. If a 
memory operand is specified, the quotient replaces the value in ST. 
Memory operands can be 32- or 64-bit real numbers or 16- or 32-bit 
integers. If no operand is specified, ST is divided by ST(1) and the 
stack is popped, returning the result in ST. For FDIVP, the source 
must be ST; the quotient is returned in the destination register and ST 
is popped. 


fdiv st, st (2) 87 193-203 
FDIV [reg,reg] fdiv st(5),st 287 = 193-203 
fdiv 387 = t=88,f=91 
fdivp st(6),st 87 197-207 
FDIVP reg,ST 287 =197-207 
387 9] 
fdiv DWORD PTR [bx] (s=2 15-225 l=220-230)+EA 
FDIV memreal fdiv shortreal {di] =2 15-225 l=220-230 
fdiv longreal s=89 1=94 


fidiv intl6 87 = (w=224-238 d=230-243)+EA 
FIDIV memint fidiv warray(di] 287 w=224-238,d=230-243 
fidiv double 387) =w=136-140,d=120-127 


FDIVR/FDIVRP/FIDIVR 


Divide Reversed 


Divides the source by the destination and returns the quotient in the 
destination. If two register operands are specified, one must be ST. If a 
memory operand is specified, the quotient replaces the value in ST. 
Memory operands can be 32- or 64-bit real numbers or 16- or 32-bit 
integers. If no operand is specified, ST is divided by ST(1) and the 
stack is popped, returning the result in ST. For FDIVRP, the source 
must be ST; the quotient is returned in the destination register and ST 
is popped. 


fdivr st,st(2) 87 194-204 
FDIVR {reg,reg] fdivr st(5),st 287 ©194-204 
fdivr 387 = t=88, f=91 
fdivrp st(6),st 87 198-208 
FDIVRP reg,ST 287 =. 198-208 
387 91 
fdivr longreal 87 (s=216-226,J=221-231)+EA 
FDIVR memreal fdivr shortreal [di] 287 = s=216-226,1=221-231 
387 =. s=89,]=94 
fidivr double 87 «= (w=225-239,d=231-245)+EA 
FIDIVR memint fidivr warray [di] 


287 w=225-239,d=231-245 
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FENI/FNENI 


Enable Interrupts 
8087 Only 


Enables interrupts by clearing the interrupt enable mask in the control 
word. This instruction has wait and no-wait versions. Since the 80287 
and 80387 do not have an interrupt enable mask, the instruction is 
recognized but ignored on these coprocessors. 


FENI feni 87 2-8 
FNENI 287 «2 
387 «2 


FFREE 


Free Register 


Changes the specified register's tag to empty without changing the 
contents of the register. 


ffree  st(3) 87 9-16 
FFREE ST(i) 287 9-16 
387 «18 


FIADD/FISUB/FISUBR/ 
FIMUL/FIDIV/FIDIVR 


Integer Arithmetic 


See FADD, FSUB, FSUBR, FMUL, FDIV, and FDIVR. 


FICOM/FICOMP 


Compare Integer 


See FCOM. 
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FILD 


Load Integer 


See FLD. 


FINCSTP 


Increment Stack Pointer 


Increments the stack top pointer in the status word. No tags or registers 
are changed and no data are transferred. If the stack pointer is 7, then 
FINCSTP changes it to 0. 


fincstp 87 6-12 
FINCSTP 287 = 6-12 
387s 21 


FINIT/FNINIT 


Initialize Coprocessor 


Initializes the coprocessor and resets all the registers and flags to their 
default values. The instruction has wait and no-wait versions. On the 
80387, the condition codes of the status word are cleared. On the 8087 
and 80287, they are unchanged. 


FINIT finit 87 2-8 
FNINIT 287 = 2-8 
387 33 


FIST/FISTP 


Store Integer 


See FST. 
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FLD/FILD/FBLD 
Load 


Pushes the specified oper::: .. onto the stack. All memory operands are 
automatically converted t« i-mporary real numbers before being loaded. 


87 17-22 

287 =-17-22 

387 614 

87 (s=38-56,]=40-60,t=53-65)+EA 

287 = s=38-56,1=40-60,t=53-65 

387 = s=20,1=25,1=44 

87 = (w=46-54,d=52-60,q=60-68)+EA 
287 }=w=46-54,d=52-60,q=60-68 

387 w=61-65,d=45-52,q=56-67 
87 (290-310)+EA 

287 =290-310 

387 266-275 


fld =< ‘ay [px+di] 
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FFLD1/FLDZ/FLDPI/FLDL2E/ 
FLDL2T/FLDLG2/FLDLN2 


Load Constant 


Pushes a constant onto the stack. The following constants can be 
loaded: 


Instruction onstant Loaded 
FLD1 +1.0 

FLDZ +0.0 

FLDPI 1 

FLDL2E Log?(e) 
FLDL2T Log?(10) 
FLDLG2 Log10(2) 
FLDLN2 Loge(2) 


fldl 15-21 
FLD1 15-21 
387 24 


87 

287 

fldz 8711-17 

FLDZ 287 11-17 
387 20 

fldpi 87 16-22 

FLDPI 287 16-22 
387 40 

FLDL2E 287 15-21 
387 40 

fldl2t 87 16-22 

FLDL2T 287 16-22 
387 40 
fldlg2 87 
FLDLG2 287 
387 

fldin2 87 

FLDLN2 


18-24 
18-24 
41 

17-23 
287. =—:17-23 
387 = 41 


FLDCW 
Load Control Word : 


Loads the the specified word into the coprocessor control word. The 
format of the control word is shown in the Interpreting Coprocessor 
Instruction section. 


fldew ctrlword 87 (7-14}+EA 
FLDCW mem32 287 3=—- 7-14 
387 19 
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Load Environment State 


Loads the 14-byte coprocessor environment state from a specified 
memory location. The environment includes the control word, status 
word, tag word, instruction pointer, and operand pointer. On the 80387 
in 32-bit mode, the environment state 1s made up of 28 bytes. 


fldenv [bp+10] 87 (35-45)+EA 
FLDENV mem 287 35-45 
387 Ss 7) 


FMUL/FMULP/FIMUL 
Multiply 


Multiplies the source by the destination and returns the product in the 
destination. If two register operands are specified, one must be ST. If a 
memory operand is specified, the product replaces the value in ST. 
Memory operands can be 32- or 64-bit real numbers or 16- or 32-bit 
integers. If no operand is specified, ST(1) is multiplied by ST and the 
stack is popped, returning the product in ST. For FMULP, the source 
must be ST; the product is returned in the destination register and ST 
is popped. 


fmul st, st (2) 87 130-145 (90-105)* 
a a Ey eats coer 
fmul 387 t=46-54 (49),f=29-57 (52)t 
fmulp st(6),st 87 134-148 (94-108)* 
FMULP reg,ST 287 =: 134-148 (94-108)* 
387 29-57 (52)t 
fmul DWORD PTR [bx] (s=1]10-125,1=154-168)+EA§ 
fmul shortreal (di+3]{ 287  s=110-125,1=154-168§ 
fmul longreal s=27-35 |=32-57 
fimul intl6 (w=124-138,d=130-144)+EA 
FIMUL memint fimul warray({di} 
fimul double 


287) =w=124-138,d=130-144 
* The clocks in parentheses show times for short values—those with 40 trailing zeros in their fraction 


w=76-87,d=61-82 
because they were loaded from a short-real memory operand. 
t The clocks in parentheses show typical speeds. 


§ If the register operand is a short value—having 40 SH zeros in its fraction because it was loaded 
teat a short-real memory operand—then the timing is (112-126)+EA on the 8087 or 112-126 on 
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FNinstuction 
No-Wait Instructions 


Instructions that have no-wait versions include FCLEX, FSAVE, 
FSTCW, FSTENYV, and FSTSW. Wait versions of instructions 
check for unmasked numeric errors; no-wait versions do not. When the 
.8087 directive is used, MASM puts a WAIT instruction before the 
wait versions and a NOP instruction before the no-wait versions. 


FNOP 


No Operation 


Performs no operation. FNOP can be used for timing delays or 
alignment. 


fnop 87 10-16 
¥ 287 = 110-16 
387 12 


FPATAN 


Partial Arctangent 


Finds the partial tangent by calculating Z = ARCTANC(Y / X). X 1s 
taken from ST and Y from ST(1). On the 8087 and 80287, Y and X 
must be in the range 0 $ Y < X < oo, On the 80387, there is no 
restriction on X and Y. X 1s popped from the stack and Z replaces Y in 


fpatan 87 250-800 
FPATAN 287 250-800 
387 314-487 
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FPREM 


Partial Remainder 


Calculates the remainder of ST divided by ST(1), returning the result 
in ST. The remainder retains the same sign as the original dividend. 
The calculation uses the following formula: 


remainder = ST -ST(1) * quotient 


The quotient is the exact value obtained by chopping ST / ST(1) 
toward 0. The instruction is intended to be used in a loop that repeats 
until the reduction is complete, as indicated by the condition codes of 
the status word. 


fprem 87 =-15-190 
287 = 15-190 
387 674-155 


Condition Codes for FPREM and FPREM1 


R 
R 
2 
8 


Meaning 

Incomplete reduction 
quotient MOD 8 = 0 
quotient MOD 8 = 4 
quotient MOD 8 = | 
quotient MOD 8 =5 
quotient MOD 8 = 2 
quotient MOD 8 =6 
quotient MOD 8 = 3 
quotient MOD 8 = 7 


——- K- OCCT ON 
cecoocoooo- 
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FPREM1 
Partial Remainder (IEEE Compatible) 
80387 Only 


Calculates the remainder of ST divided by ST(1), returning the result 
in ST. The remainder retains the same sign as the original dividend. 
The calculation uses the following formula: 


remainder = ST -ST(1) * quotient 


The quotient is the integer nearest to the exact value ST / ST(1). If 
there are two integers equally close, the even integer is used. The 
instruction is intended to be used in a loop that repeats until the 
reduction is complete, as indicated by the condition codes of the status 
word. See FPREM for the possible condition codes. 


fpreml 87 — 
237 — 
387 95-185 


FPTAN 


Partial Tangent 


Finds the partial tangent by calculating Y / X = TAN(Z). Z is taken 
from ST. Z must be in the range 0 < Z <1 / 4 on the 8087 and 
80287. On the 80387, IZI must be less than 263. The result is the ratio 
Y /X. Y replaces Z, and X is pushed into ST. Thus Y is returned in 
ST(1) and X in ST. 


fptan 87 30-540 
FPTAN 287 = =30-540 
387 =191-497* 


* For operands with an absolute value greater than 7/4, up to 76 additional clocks may be required. 
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Round to Integer 


Wow U 


Rounds ST from a real number to an integer. The rounding control 
(RC) field of the control word specifies the rounding method, as shown 
in the introduction to this section. 


frndint 87 ~=16-50 
FRNDINT 287 ~=—-16-50 
387 66-80 


"ie ie! ee” ® 


WW Ww 


FRSTOR 


Restore Saved State 


Restores the 94-byte coprocessor state to the coprocessor from the 
specified memory location. In 32-bit mode on the 80387, the 
environment state takes 108 bytes. 


frstor (bp-94] 87 (197-207)+EA 
FRSTOR mem94 287 = * 
387 =. 3008 


; 

) 

ial * Clock counts are not meaningful in determining overall execution time of this instruction. Timing is 
| ers. 


mi 


ve 


determined by operand trans 


FSAVE/FNSAVE 


Save Coprocessor State 


Stores the 94-byte coprocessor state to the specified memory location. 
In 32-bit mode on the 80387, the environment state takes 108 bytes. 
This instruction has wait and no-wait versions. After the save, the 
coprocessor is initialized as if FINIT had been executed. 


FSAVE m94 fsave [bp-94] 87 (197-207)+EA 
FNSAVE m94 fsave cobuffer 287 * 
387 =. 3375-376 


* Clock counts are not ipod Ue in determining overall execution time of this instruction. Timing is 
determined by operand transfers. 
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FSCALE 


Scale 


Scales by powers of two by computing the function Y = Y * 2%. X is 
the scaling factor taken from ST(1), and Y is the value to be scaled 
from ST. The scaled result replaces the value in ST. The scaling factor 
remains in ST(1). If the scaling factor is not an integer, it will be 
truncated toward zero before the scaling. 


The 80387 has no restrictions on the range of operands, but on the 
8087 and 80287, if X is not in the range -2!> < X <2!5 or if X is in 
the range 0 < X < 1, the result will be undefined. 


fscale 87 32-38 
FSCALE 287 32-38 
387 67-86 


FSETPM 


Set Protected Mode 
80287 Only 


Sets the 80287 to protected mode. The instruction and operand pointers 
are in the protected mode format after this instruction. On the 80387, 
FSETPM is recognized but interpreted as FNOP, since the 80386 
handles addressing identically in real and protected mode. 


fsetpm 87 — 
FSETPM 287 = 2-8 
387 =12 
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FSIN 
Sine 
80387 Only 


Replaces a value in radians in ST with its sine. If ST is in the range 
IST| < 263, then the C2 bit of the status word is cleared and the sine is 
calculated. Otherwise, C2 is set and no calculation is done. ST can be 
reduced to the required range with FPREM or FPREM1. 


fsin $7 
FSIN 237. — 
387 =: 122-771* 


* For operands with an absolute value greater than 77/4, up to 76 additional clocks may be required. 


FSINCOS 


Sine and Cosine 
80387 Only 


Computes the sine and cosine of a radian value in ST. The sine 
replaces the value in ST and then the cosine is pushed onto the stack. 
If ST is in the range IST! < 2®3, the C2 bit of the status word is 
cleared and the sine and cosine are calculated. Otherwise, C2 is set and 
no calculation is done. ST can be reduced to the required range with 
FPREM or FPREMI1. 


fsincos 87 — 
FSINCOS 237 — 
387  194-809* 


* For operands with an absolute value greater than 7/4, up to 76 additional clocks may be required. 
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FSQRT 


Square Root 


Replaces the value of ST with its square root. (The square root of -0 


is -0.) 


fsqrt 
FSQRT 


87 180-186 


287 180-186 


387. 122-129 


FST/FSTP/FIST/FISTP/FBSTP 


Store 


Stores the value in ST to the specified memory location or register. 
Temporary real values in registers are converted to the appropriate 


integer, BCD, or floating-point format as they are stored. With FSTP, 


FISTP, and FBSTP, the ST register value is popped off the stack. 


FSTP reg 


fostp bcds [bx] 
FBSTP membcd 


fst st (6) 
fst st 


fstp st 
fstp  st(3) 


fst shortreal 
fst longs {bx] 


fstp longreal 
fstp tempreals [bx] 


fist intl6 
fist doubles{[8) 


fistp longint 
fistp doubles [bx) 
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87 615-22 
287 15-22 
387 11 
87 17-24 
287 17-24 
387 12 
87 (s=84-90,1=96-104)}+EA 
287 = s=84-90,1=96-104 
387 s=44,l=45 
87 = (s=86-92,1=98-106,t=52-58)+EA 
287  s=86-92,1=98-106,t=52-58 
387 «= s=44,1=45 t=53 
87 (w=80-90,d=82-92)+EA 
287. =w=80-90,d=82-92 
387 w=82-95,d=79-93 
87 (w=82-92,d=84-94,q=94-105)+EA 
287 =w=82-92,d=84-94 q=94-105 
387 w=82-95,d=79-93,q=80-97 
87 (520-540)+EA 
287 520-540 
387 512-534 
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FSTCW/FNSTCW 
Store Control Word 


Stores the control word to a specified 16-bit memory operand. This 
instruction has wait and no-wait versions. 


FSTCW fstcw ctrlword 87 =:12-18 
FNSTCW 287 12-18 
387 «15 


FSTENV/FNSTENV 


Store Environment State 


Stores the 14-byte coprocessor environment state to a specified 
memory location. The environment state includes the control word, 
status word, tag word, instruction pointer, and operand pointer. On the 
80387 in 32-bit mode, the environment state is made up of 28 bytes. 


FSTENV mem fstenv (bp-14]) 87 (40-50)+EA 
FNSTENV mem 287 40-50 
387 =103-104 


FSTSW/FNSTSW 
Store Status Word 


Stores the status word to a specified 16-bit memory operand. On the 
80287 and 80387, the status word can be stored also to the processor's 
AX register. This instruction has wait and no-wait versions. 


FNSTSW mem 287 =: 12-18 
387 =«15 

FSTSW AX fstsw ax 87 — 
387 =«:13 
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FSUB/FSUBP/FISUB 
Subtract 


mim 
Ww 


ry 


Subtracts the source from the destination and returns the difference in 
the destination. If two register operands are specified, one must be ST. 
If a memory operand is specified, the result replaces the value in ST. 
Memory operands can be 32- or 64-bit real numbers or 16- or 32-bit 
integers. If no operand is specified, ST is subtracted from ST(1) and 
the stack 1s popped, returning the difference in ST. For FSUBP, the 
source must be ST; the difference (destination minus source) is 
returned in the destination register and ST is popped. 


mm AP 
A 
ae ee ee” ee? ee? Pe? 


fsub st, st (2) 87 70-100 
FSUB [reg,reg] fsub st(5),st 287 70-100 
fsub 387 = t=29-37 .f=26-34 
fsubp st(6),st 87 75-105 
FSUBP reg,ST 287 =—75-105 
387 26-34 


fsub liongreal 87 (s=90-120,s=95-125)+EA 
FSUB memreal fsub shortreals[{di]} | 287  s=90-120,1l=95-125 
387 s=24-32,]=28-36 
fisub double 87 = (w=102-137,d=108-143)+EA 
FISUB memint fisub warray([di] 287 =w=102-137.d=108-143 
387 3=w=71-83.d=57-82 
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FSUBR/FSUBRP/FISUBR 


Subtract Reversed 


Subtracts the destination operand from the source operand, and returns 
the result in the destination operand. If two register operands are 
specified, one must be ST. If a memory operand is specified, the result 
replaces the value in ST. Memory operands can be 32- or 64-bit real 
numbers or 16- or 32-bit integers. If no operand is specified, ST(1) is 
subtracted from ST and the stack is popped, returning the difference in 
ST. For FSUBRP, the source must be ST; the difference (source 
minus destination) is returned in the destination register and ST is 


popped. 


fsubr st,st(2) 87 70-100 
FSUBR [reg,reg} fsubr st(5),st 287 70-100 
fsubr 387 = t=29-37 f=26-34 
fsubrp st(6),st 87 75-105 
FSUBRP reg,ST 287 75-105 
387 26-34 
fsubr QWORD PTR [bx] (s=90-120,s=95-125)+EA 
FSUBR memreal fsubr shortreal([di) s=90-120,1=95-125 
fsubr longreal 
fisubr intl6 
FISUBR memint fisubr warray[di} 
fisubr double 


$=25-33,J=29-37 
(w=103-139,d=109-144)+EA 
w=103-139,d=109-144 

w=72-84,d=58-83 


FIST 


Test for Zero 


Compares ST with +0.0 and sets the condition of the status word 
according to the result. 


ftst 87 38-48 
FTST 287 38-48 
387 = 28 


Condition Codes for FTST 


CG Cf Ca Meaning 


0 0 ? 0 ST is positive 

0 0 ? ] ST is negative 

1 0 ? 0 ST is 0 

l ] 2 1 ST is not comparable (NAN or projective infinity) 


COPROCESSOR INSTRUCTIONS _139 


FUCOM/FUCOMP/FUCOMPP 


Unordered Compare 
80387 Only 


Compares the specified source to ST and sets the condition codes of 
the status word according to the result. The instruction works by 
subtracting the source operand from ST without changing either 
operand. Memory operands are not allowed. If no operand is specified or 
if two pops are specified, ST is compared to ST(1). If one pop is 
specified with an operand, the given register is compared to ST. 


FUCOM differs from FCOM in that it does not cause an invalid- 
operation exception if one of the operands 1s a NAN. Instead, the result 


iS set to unordered. 


fucom st(2) 
FUCOM [reg] fucom 


fucomp st (7) 
FUCOMP [reg] fucomp 
fucompp 
FUCOMPP 
387 


Condition Codes for FUCOM 


C3 c2 Cl CQ ~~ Meaning 


0 0 ? 0 ST > source 
0 0 ? I ST < source 
l 0 ? 0 ST = source 
] J ss l Unordered 


FWAIT 
Wait 


Suspends execution of the processor until the coprocessor is finished 
executing. This is an alternate mnemonic for the processor WAIT 
instruction. 
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FXAM 


Examine 


Reports the contents of ST in the condition flags of the status word. 


fxam 87 = =12-23 
FXAM 287 3 =12-23 
387 30-38 


Condition Codes for FXAM 


Cl CO t tati 
+ Unnormal* 
+NAN 

- Unnormal* 
- NAN 

+ Normal 

+ Infinity 

- Normal 


B 
B 


- Infinity 
+0 

Empty 

-0 

Empty 

+ Denormal 
Empty* 

- Denormal 
Empty* 


—~SK COC O-- OOK eK OO 


* Not used on the 80387. Unnormals are not supported by the 80387. Also, the 80387 uses two codes 
instead of four to identify empty registers. 


FXCH 


Exchange Registers 


Exchanges the specified (destination) register and ST. If no operand is 
specified, ST and ST(1) are exchanged. 


fxch st(3) 87 8610-15 
FXCH [reg] fxch 287 ~=—s: 10-15 
387 18 
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| 
FXTRACT | 


Extract Exponent and Significand 


replaces the value in ST, and then the significand is pushed onto the 
stack. 


fxtract 87 27-55 
FXTRACT 287 27-55 Es 
387 70-76 


Extracts the exponent and significand fields of ST. The exponent c. 
op 


fm my 


FYL2X 
Y¥ loga(X) 


Calculates Z = Y logo(X). X is taken from ST and Y from ST(1). 
The stack 1s popped and the result, Z, replaces Y in ST. X must be in 
the range 0 < X < c© and Y in the range -co < Y < ©9, 


fyl2x 87 900-1100 
FYL2X 287 900-1100 
387 =: 120-538 
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FYL2XP1 
Y log2(X+1) 


Calculates Z = Y logo(X + 1). X is taken from ST and Y from 
ST(1). The stack is popped once and the result, Z, replaces Y in ST. 
X must be in the range 0 < IX! < (1 - (V2 /2). Y must be in the range 
-00 < Y < 00, 


fyl2xpl 87 700-1000 
FYL2XP1 287 700-1000 
387 257-547 
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DOS Program Segment Prefix (PSP) 
ASCII Chart 

Key Codes 

Color Display Attributes 
Hexadecimal-Binary-Decimal Conversion 
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DOS Program Segment Prefix (PSP) 


—. 


Opcode for INT 20h 


Segment of first allocatable address following the program (useful for 
memory allocation) 


Opcode for far call to DOS function dispatcher 
Vector for terminate routine 

Vector for CTRL+BREAK routine 

Vector for error routine 

Segment of program's copy of the environment 


Opcode for DOS INT 21h and far return (you can do a far call to this 
address to execute DOS calls) 


First command-line argument (formatted as uppercase 1 1-character file 
name) 


Second command-line argument (formatted as uppercase 11-character file 
name) 


Number of bytes in command line argument 
Unformatted command line and/or default Disk Transfer Area (DTA) 
Reserved or used by DOS 
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ASCII Codes 


Ctrl Dec Hex Char Code 
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A 
B 
¢ 
D 
E 
F 
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H 
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Pee KONE xK ECT eS RW OT Be eo. Sig LO Oo 


etrt + +---~oWw 
one FEO 8 9 0 00 BIN On WO PO ee 


<4 
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t+ ASCII code 127 has the code DEL. Under DOS, this code has the same effect as ASCII 
8 (BS). The DEL code can be generated by the CTRL-BKSP key. 
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Dec Hex Char 


hoy II -HE RD 1 OLE! EEO 0: O> Ty A De ed i! ID Be ww Ad DEO 


Dec Hex Char 


MM Rem Kd 1 ois im ZIDt Ee. Os Pe 


ad sSo ots. 1.  S0nt ene «-: 
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Dec Hex Char 


“lili =n reseoart il ride e 


ed 
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Dec Hex Char 


“Es Fz 


S&S 22 -j-e “ONIN IY It Ho SB. OB om PDhweIR TE ABM a 
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Key Codes 


Scan ASCII or ASCII or ASCII or ASCII or 
Code Extended* Extendedt Extended* Extendedt 
with Shift with Ctrl with Alt 
Dec Hex Char | Dec Hex Char | Dec Hex Char | Dec Hex Char 


Key 


1 Ol] 27 IB 27 ~=#1B 27 ~=1B 
2 49 31 1 33 21s! 
3 50 32 2 64 40 @ 3 
4 51 33 3 35 23 # 
5 52 34 4 36 24 § 
6 53 35 5 37 25 & 
7 54 36 6 94 SE * 
8 55 37 7 38 26 = «& 
9 56 38 8 42 2A * 
10 57 39 9 40 28 ( 
1] 48 30 0 41 29 ) 
12 45 2D - 95 5F - 
= 43 2B + 


OmC<AAMEO 


——DOr CK tH ® £ Q 
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rs 
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~““~WDOHAQAKAARMEZOC 
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{ | 123. 7B 

1] 125 7D 
ENTER 13 OD CR 
CTRL 

A a A 
S 8 S 
D d D 
F £ F 
G g G 
H h H 
J 5 J 
K k K 
L 1 L 


id 
Wo) 
tw 
~J 


+ Extended codes retum NUL (ASCII 0) as the initial character. This is a signal that a second 
(extended) code is available in the keystroke buffer. 
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Key Scan ASCII or ASCII or ASCII or ASCII or 
Code Extendedt Extended? Extendedt Extendedt 

with Shift with Ctrl with Alt 

ae Dec Hex Char | Dec Hex Char | Dec Hex Char | Dec Hex Char 


SsBVodCNQ KN SY 


ZAZwW<OXN 


IVA 
YVVARZWdaAxXN— 


'woo~ 


Oo WNKHF +AU & 


t Extended codes retum NUL (ASCII 0) as the initial character. This is a signal that a second 
(extended) code is available in the keystroke buffer. 

§ Under DOS, Shift-PtrScr causes interrupt 5, which prints the screen unless an interrupt handler 
has been defined to replace the default interrupt 5 handler. 
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Color Display Attributes 


Background 


Foreground 
Bits Num_ Color Bits* Num_ Color 
FRG B IRGB | 
0000 OQ. Black 0000/0. Black 
0001 1 Blue 000 fF 1 Blue 
0010 2 _. Green 0020 2° Green 
0011 #3  °£42Cyan 0011 3. Cyan 
0100 4 ~ Red 0,1 0 0 4 Red 
0101 #5  £4xMagenta -O 10 1 5 Magenta 
01 10 6. Brown 01 10 #46. Brown 
O1l11 1 #7 White | 0111 7 ~~ White 
1000 8 © Black: blink 1000 8 Dark grey 
100 1 9 _ Blue blink 1001 9  =Light blue 
1010 A Green blink 101 0 A Light green 
101% B- Cyan blink 101 1 B- Light cyan 
1100 #C_ Red blink 1 100 C Light red 
1 101 #D~ Magenta blink 1 1 0 1 D_ Light magenta 
1 110  E ~ Brown blink 1 110 E Yellow 
111 1  #+F White blink 1111 F Bright white 
I Intensity bit G_ Green bit F Flashing bit 
R_ Red bit B Blue bit 


* On monochrome monitors, the blue bit is set and the red and green bits are cleared (001) for 
underline; all color bits are set (111) for normal text. 


Hexadecimal-Binary-Decimal Conversion 


Hex Binary 
Number 


Number 


0000 
0001 
0010 
0011 
0100 
0101 


AMOAW> OMAINANAWN—OD 


0110 
O1l1 
1000 
1001 
1010 
1011 
1100 
1101 
1110 
1111 


Decimal Decimal Decimal Decimal 
DigitQOOX DigitOOXO DigitOX00 Digit XO00 

0 0 0 0 

l 16 256 4,096 

2 32 512 8,192 

3 48 768 12,288 

4 64 1,024 16,384 

5 80 1,280 20,480 

6 96 1,536 24,576 

7 112 1,792 28,672 

8 128 2,048 32,768 

9 144 2,304 36,864 

0 160 2,560 40,960 

lt 176 2,816 45,056 

12 192 3,072 49,152 

13 208 3,328 53,248 

14 224 3,584 57,344 

15 240 3,840 61,440 
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